# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.201
country_id: 6290252
description:
Dec 28 09:37:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=109.207.35.201, lip=66.85.158.91, TLS, session=</vz8QvtGV6RtzyPJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 28 09:37:44 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<z/e7RPtGzsE26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 28 09:37:44 host2 sshd[3139674]: Disconnected from invalid user xtest 165.154.97.28 port 48496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.112.9
country_id: 3469034
description:
Dec 28 09:37:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.39.112.9, lip=66.85.158.91, TLS, session=<dasYRPtGRJWxJ3AJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 09:38:47 host2 sshd[3140657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 09:39:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QEqZTPtG0I0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.107.193
country_id: 1269750
description:
Dec 28 09:41:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.87.107.193, lip=66.85.158.91, TLS, session=<5LnzT/tGA5xnV2vB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.48
country_id: 2300660
description:
Dec 28 09:41:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.11.48, lip=66.85.158.91, TLS, session=<2Nk0UftGw8opiwsw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 09:41:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gu7UU/tGxJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 09:42:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<kz74VvtGxMzBl4nP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:24 host2 sshd[3144614]: error: maximum authentication attempts exceeded for invalid user admin from 62.169.238.187 port 56350 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:27 host2 sshd[3144640]: Disconnecting invalid user admin 62.169.238.187 port 54058: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 09:43:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<M9TBWvtGclSnYwhf>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:13 host2 sshd[3144454]: Disconnecting authenticating user root 62.169.238.187 port 39176: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:13 host2 sshd[3144454]: error: maximum authentication attempts exceeded for root from 62.169.238.187 port 39176 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 09:43:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LQ+BWPtGvwtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 09:46:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<sb+MYvtG+ounrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 09:47:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QKp/ZvtGouunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-28 09:47:19 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:36921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-28 09:47:38 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:62878: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 09:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0aRqe/tGHodV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 09:52:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<4zS1ePtGkrQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2025-12-28 09:54:05 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:48650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:54:33 host2 sshd[3154305]: Disconnected from invalid user titan 154.83.15.92 port 56484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 09:54:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<auZIgftGpr0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:55:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QWt3g/tGdJAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:58:05 host2 sshd[3157028]: Disconnected from invalid user pal 154.83.15.92 port 41518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:58:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<S04HkPtGULozTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:59:22 host2 sshd[3157931]: Disconnected from invalid user boss 154.83.15.92 port 41174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-28 09:59:24 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:50436: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 10:00:06 host2 sshd[3158598]: Disconnected from invalid user red 154.83.15.92 port 55124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 10:01:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GEPXmftG1J0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 10:03:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<GDERoftG/KkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:03:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<CjR2oftGjLkv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.32.140
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.32.140 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 10:05:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<MWzxqPtGioai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 10:06:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N4j1q/tG7qsv7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:13 host2 pure-ftpd[3163994]: (?@85.217.149.20) [INFO] New connection from 85.217.149.20


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 28 10:07:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, session=<cdVKrvtGSotV2YwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.91, TLS: Connection closed, session=<n6uRrvtGdJZV2ZUU>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:29 host2 pure-ftpd[3164164]: (?@85.217.149.20) [INFO] New connection from 85.217.149.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 10:07:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<JguPsPtG1JgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 10:09:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<30YRt/tGOqpA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 28 10:11:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.91, TLS: Connection closed, session=<KRU3vftGsJYfDiAG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 10:18:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6wb/1/tGkIUjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 10:18:17 host2 sshd[3172514]: Disconnected from invalid user markus 62.60.131.157 port 17673 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:21:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1eX03/tGmsYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 10:21:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<g2Rt4PtG2mZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 10:21:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<1Cf04PtGtoWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 10:22:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<yCHK4/tGKJCElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 10:24:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bDc36vtGBIakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 10:24:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<86BZ6vtGns2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 10:24:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<swNv7ftG3JGi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:25:19 host2 sshd[3177851]: Disconnected from invalid user john 51.91.252.38 port 48846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:25:53 host2 sshd[3178184]: Disconnected from invalid user openbravo 51.91.252.38 port 45084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:26:29 host2 sshd[3178686]: Disconnected from invalid user virtualbox 51.91.252.38 port 40374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-28 10:28:17 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:40196: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:28:30 host2 sshd[3179983]: Disconnected from invalid user mohamed 118.194.230.231 port 40958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-28 10:28:31 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:45502: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-28 10:28:54 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:56947: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 10:29:08 host2 pure-ftpd[3180546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 28 10:29:41 host2 sshd[3180878]: Disconnected from invalid user john 93.71.118.99 port 37540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-28 10:29:14 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:46186: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 28 10:29:29 host2 sshd[3180726]: Disconnected from invalid user david 101.36.108.134 port 60628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 10:30:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<j+AJAfxGAKFnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 28 10:30:49 host2 sshd[3181800]: Disconnected from invalid user user11 138.124.158.147 port 42698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:30:55 host2 sshd[3181862]: Disconnected from invalid user admin 118.194.230.231 port 41142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:32:33 host2 sshd[3183066]: Disconnected from invalid user infra 118.194.230.231 port 41284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 10:32:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zze3CfxGiGEjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 28 10:32:25 host2 sshd[3182951]: Disconnected from invalid user deploy 101.36.108.134 port 49312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 10:34:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XQZMEPxGZPmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 10:35:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<euyQE/xGEOov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.30.104
country_id: 933860
description:
Dec 28 10:36:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=83.143.30.104, lip=66.85.158.91, TLS, session=<vP0dF/xGn8pTjx5o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 10:36:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<JJ2HGPxG6TNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 10:37:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<EUeDG/xGlujBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.214
country_id: 3865483
description:
Dec 28 10:37:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=181.191.223.214, lip=66.85.158.91, TLS, session=<QualGPxGwcG1v9/W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.221
country_id: 3175395
description:
Dec 28 10:40:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.221, lip=66.85.158.91, TLS, session=<D+PZJPxG06nZGrPd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.178.136
country_id: 3175395
description:
Dec 28 10:40:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.178.136, lip=66.85.158.91, TLS, session=<+B/FI/xGGY7ZGrKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 10:41:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9SVnKfxGap6nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 10:42:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<cUnWKvxGGuWnrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 10:42:54 host2 sshd[3190453]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 10:43:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<RtdeMPxGRpMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2025-12-28 10:44:48 dovecot_login authenticator failed for H=([122.187.223.78]) [182.66.214.34]:40054: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-28 10:45:46 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:51403: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Dec 28 10:45:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS, session=<8Vq3OPxGAOLN0h9Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.44
country_id: 6252001
description:
Dec 28 10:46:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.44, lip=66.85.158.91, session=<x7v8OPxG7OLG6xgs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 10:46:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<KZ6TO/xG2KozTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.128.65.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.128.65.57 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 10:47:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54177: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-28 10:48:24 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:47270: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 10:48:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<sK++QfxGuKFV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 10:48:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uCTdQfxG1p0v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2025-12-28 10:48:53 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:47394: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2025-12-28 10:50:03 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:39464: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 10:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<BNprSPxGppszTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.128.65.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.128.65.88 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:56:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JtiqXfxGypAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 10:56:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ejD6XvxGQLei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 10:57:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<wyYFYvxGEpUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 10:59:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2hQQafxGgKoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:00:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DSWMbPxGxosv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.2.69
country_id: 6251999
description:
Dec 28 11:00:58 host2 sshd[3204195]: Disconnected from invalid user docker 159.203.2.69 port 56788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-28 11:01:01 dovecot_login authenticator failed for H=([122.187.223.252]) [122.186.202.10]:50426: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 177.136.229.18 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-28 11:01:43 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-28 11:02:01 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (onpres) [73.213.236.66]:59894: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 11:02:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<RHIWdfxGlMBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 11:02:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OfIYdfxG1N8vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 11:02:59 host2 sshd[3205756]: Disconnected from invalid user  62.60.131.157 port 50436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-28 11:02:11 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:37607: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:02:32 host2 sshd[3205460]: Disconnected from invalid user steam 43.133.148.170 port 57586 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 177.136.229.18 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 177.136.229.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 11:06:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<q3ttgPxG+GZo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:06:17 host2 sshd[3208372]: Disconnected from invalid user ali 43.133.148.170 port 37606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:07:02 host2 sshd[3208949]: Disconnected from invalid user testuser 43.133.148.170 port 34454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:07:40 host2 sshd[3209352]: Disconnected from invalid user ansible 43.133.148.170 port 50914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:10:42 host2 sshd[3211909]: Disconnected from invalid user admin 43.133.148.170 port 42588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-28 11:12:02 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:24055: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.219.172.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.219.172.19 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.206.26
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 75.4.206.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.26.7
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.30.26.7 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.40.110
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.181.40.110 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.166.165
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.166.165 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.171.137.245
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.171.137.245 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-28 11:12:24 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:42786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 11:12:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kcc5l/xGXIsjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.254.198
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.135.254.198 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.156.187
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.88.156.187 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.109.206.85
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.109.206.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.247.203
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.37.247.203 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.1.36.62
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.1.36.62 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.124.23.54
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 52.124.23.54 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.142.7.37
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.142.7.37 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.37
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.16.37 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 11:13:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jNGwnPxGnrcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 11:14:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<X6VBoPxGiLh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 11:14:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<89wKoPxGKsal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 11:17:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<b31oqfxGtpWkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 11:19:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9PwKsPxGmsyi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.247
country_id: 6252001
description:
Dec 28 11:19:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=147.185.133.247, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CfxosPxG+uiTuYX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 11:19:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<spoHsvxGPN6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 11:20:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<ckA/s/xGpt+ElEgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.48
country_id: 6252001
description:
Dec 28 11:21:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.48, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rVibufxGYrASYQUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.173
country_id: 6252001
description:
Dec 28 11:21:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.173, lip=66.85.158.92, session=<mYQat/xGwqEs3Lyt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.203.2.69
country_id: 6251999
description:
Dec 28 11:23:04 host2 sshd[3221599]: Disconnected from invalid user admin 159.203.2.69 port 43038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 50.18.30.174
country_id: 6252001
description:
Dec 28 11:23:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=50.18.30.174, lip=66.85.158.91, TLS: Connection closed, session=<9W0YvvxGVqcyEh6u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.57.30.225
country_id: 6252001
description:
Dec 28 11:23:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.57.30.225, lip=66.85.158.92, TLS: Connection closed, session=<xt2rwPxGhIgNOR7h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:24:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YdnjwPxGcJrPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:24:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: Connection closed, session=<9wN4wfxGLL3PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.247
country_id: 6252001
description:
Dec 28 11:24:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.247, lip=66.85.158.92, TLS, session=<HvILxPxGCvKTuYX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-28 11:25:45 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:60751: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 11:25:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7WSax/xGYINnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 11:25:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<7R+kx/xG+NunYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-28 11:26:00 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:41044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 11:26:29 host2 sshd[3224105]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 11:26:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dpO0yfxGPoUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-28 11:26:36 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:36068: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-28 11:26:57 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:59306: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 11:29:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<53cX1vxGiMkv+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 11:32:06 host2 pure-ftpd[3228149]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:32:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<7wXl4PxGAq7PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:33:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: Connection closed, session=<5i6r4fxG+q3PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 11:36:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<5que6/xG3O0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 11:36:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<LP+y6/xGspDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.138
country_id: 226074
description:
Dec 28 11:35:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=196.0.87.138, lip=66.85.158.91, TLS, session=<NxAv6vxGcLzEAFeK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.70
country_id: 1269750
description:
Dec 28 11:36:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=103.18.166.70, lip=66.85.158.91, TLS, session=<H25x6/xGhOtnEqZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 11:37:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9km98PxGsN2nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 11:38:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KB2x9PxG6t2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 11:39:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<SoTR9/xGHM4zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.179.188.238
country_id: 3469034
description:
Dec 28 11:39:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=45.179.188.238, lip=66.85.158.91, TLS, session=<vp8q9/xG2e0ts7zu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.97
country_id: 3996063
description:
Dec 28 11:39:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=38.65.137.97, lip=66.85.158.91, TLS, session=<bKhy+PxGgoUmQYlh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.83
country_id: 1269750
description:
2025-12-28 11:41:55 dovecot_login authenticator failed for H=([122.187.230.83]) [122.187.230.83]:32982: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-28 11:42:13 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:59566: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-28 11:42:28 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:47573: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:42:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7XdpA/1Glo4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-28 11:43:05 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:50244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 11:43:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<HBfXBP1GNtMzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-28 11:43:30 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:43694: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-28 11:43:59 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:43972: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-28 11:43:25 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:43600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 11:45:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<f5fNC/1G7NtV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 28 11:46:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<hop9Ef1GxHJChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 11:47:29 host2 sshd[3242288]: Disconnected from invalid user maci 62.60.131.157 port 26787 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 28 11:47:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<MRFiFf1GbvVChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 11:48:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tnHDFv1GuMWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 11:49:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<M+5RG/1GRrAv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-28 11:53:42 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:35532: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 11:53:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ArrpK/1GasQFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 28 11:53:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.92, TLS: Connection closed, session=<zeLsKf1GgK2VHDF7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-28 11:54:25 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:55791: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 24.144.92.201
country_id: 6252001
description:
Dec 28 11:54:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=24.144.92.201, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<hMmzLv1GvNsYkFzJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:54:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<E06gLv1GeOwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-28 11:56:53 dovecot_login authenticator failed for H=(201.173.56.28-clientes-izzi.mx) [201.173.56.28]:60848: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-28 11:57:02 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:38216: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 11:57:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<8PPrNv1GYssyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 11:59:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<TDazP/1GVrsvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.66
country_id: 6252001
description:
Dec 28 11:59:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LHs5Qf1Gj8zN0h9C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 12:00:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WwHsQv1GMmxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-28 12:01:05 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-28 12:01:34 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:53318: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:04:13 host2 sshd[3256985]: Disconnected from invalid user karim 20.12.41.6 port 59406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 12:05:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<E+hIU/1GFIhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-28 12:05:11 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:34364: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.23.217
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.23.217 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.215.183.191
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.215.183.191 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.224.173.151
country_id: 3175395
description:
2025-12-28 12:05:56 dovecot_login authenticator failed for H=([83.224.173.151]) [83.224.173.151]:39962: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.206.227.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.206.227.89 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.108.100
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.203.108.100 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:05:47 host2 sshd[3258403]: Disconnected from invalid user gitlab-runner 20.12.41.6 port 42798 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.216.143.226
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.216.143.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.151.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.243.151.57 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.131.159 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.231.126
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.30.231.126 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.92.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.155.92.244 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.132
country_id: 6252001
description:
Dec 28 12:05:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.132, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<e8E1Vf1GCc+TuYSE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.24.188.196
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.24.188.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.124.173.220
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.124.173.220 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.80.245
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 68.230.80.245 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.137.191.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.137.191.162 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.109.42
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.109.42 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 12:06:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UPrTWP1GdOUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 12:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<m8mcW/1GRLEv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:07:34 host2 sshd[3259765]: Disconnected from invalid user git 20.12.41.6 port 35960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 12:09:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<qFkkYv1GRqGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 12:10:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dm3SZ/1GFIh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 12:12:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</cV2bP1GhICkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 12:13:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<oMhScf1GEOxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 12:14:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qKrVdf1GKpii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 12:17:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<E7Ywgf1G1DmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 12:17:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<mTYbgf1GFoynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 12:19:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<ub2mh/1GcsCElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 12:20:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fXu6i/1GxKUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 12:22:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<66q9kP1GMolnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 12:25:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<NfQcm/1GcKov+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2025-12-28 12:26:32 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:56164: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-28 12:26:50 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:48156: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 12:29:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Vfwpqv1GyOYuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 12:30:44 host2 sshd[3277219]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.192.245
country_id: 6252001
description:
Dec 28 12:30:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.192.245, lip=66.85.158.91, session=<ytCcrf1GvuxK+cD1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2025-12-28 12:31:01 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:34497: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.44.137.178
country_id: 798549
description:
2025-12-28 12:31:23 dovecot_login authenticator failed for H=([89.44.137.178]) [89.44.137.178]:41426: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 12:33:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<OD6Yt/1GEOYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 12:33:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<ujsQuv1G5J+nrEV8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 12:35:06 host2 pure-ftpd[3280533]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 12:34:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<gXdkvf1GdunBl4nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.144
country_id: 6252001
description:
Dec 28 12:35:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=199.45.154.144, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<Reu1v/1GwtzHLZqQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 12:36:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<aC/CxP1GBIczTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 12:36:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<qvmWxf1GUMynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 12:37:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Kw8lxv1G2u0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:37:37 host2 sshd[3282868]: Disconnected from invalid user amir 85.18.236.229 port 42922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 12:38:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XnIIzP1GkkVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:39:18 host2 sshd[3284498]: Disconnected from invalid user user 85.18.236.229 port 44142 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 28 12:39:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<0Ipvzv1GwowsyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 12:39:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jQHBz/1GDO6i8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:39:49 host2 sshd[3285042]: Disconnected from invalid user ubuntu 85.18.236.229 port 55948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:40:50 host2 sshd[3286183]: Disconnected from invalid user git 85.18.236.229 port 51328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.200
country_id: 2413451
description:
2025-12-28 12:41:26 dovecot_login authenticator failed for H=([197.255.199.200]) [197.255.199.200]:36333: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-28 12:41:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:15475: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:42:26 host2 sshd[3287734]: Disconnected from invalid user steam 85.18.236.229 port 58524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 12:42:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iKLz2v1Gzr8v/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.109.215.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 208.109.215.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:43:30 host2 sshd[3288853]: Disconnected from invalid user user 74.48.141.135 port 35768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Dec 28 12:43:31 host2 sshd[3288840]: Disconnected from invalid user git 186.86.52.137 port 21827 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-28 12:44:23 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36566: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 12:44:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<Nw/74P1GzqDJvgxi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Dec 28 12:44:44 host2 sshd[3290035]: Disconnected from invalid user user 186.86.52.137 port 8311 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2025-12-28 12:44:54 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:48224: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.194
country_id: 2510769
description:
Dec 28 12:46:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=139.28.190.194, lip=66.85.158.91, TLS, session=<QAF/5f1GdM+LHL7C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.129
country_id: 3175395
description:
Dec 28 12:46:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.15.168.129, lip=66.85.158.91, TLS, session=<KbCJ5v1GNIm5D6iB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.210
country_id: 6252001
description:
Dec 28 12:47:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.210, lip=66.85.158.92, session=<kXdJ6/1GLOOTuYTS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:48:03 host2 sshd[3293766]: Disconnected from invalid user admin 74.48.141.135 port 46146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:48:35 host2 sshd[3294254]: Disconnected from invalid user jenkins 74.48.141.135 port 53292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 12:49:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<vP088f1GkNsv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-28 12:48:20 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:50656: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-28 12:48:30 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:53520: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.246.210.57
country_id: 798544
description:
Dec 28 12:49:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=91.246.210.57, lip=66.85.158.91, TLS, session=<zc+h8f1GcsJb9tI5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.60
country_id: 2963597
description:
Dec 28 12:49:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.203.48.60, lip=66.85.158.91, TLS, session=<F2+z8v1GpNQlyzA8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 12:51:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<KkCI+P1GgtkFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.78
country_id: 6252001
description:
Dec 28 12:53:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.78, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P4gf//1GTtaTuYRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 12:55:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<soTgB/5G4sxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 12:55:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<K51RCP5Gyo0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 12:56:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<CEgwDf5GPpgvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-28 12:59:07 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:42804: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-12-28 12:58:37 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:52100: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<yzXUGv5GDKwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:00:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kw0VG/5GDLcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 13:03:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<208/I/5G+qal6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 28 13:04:49 host2 pure-ftpd[3308534]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:05:23 host2 sshd[3309131]: Disconnected from invalid user admin 103.26.136.173 port 45380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:06:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KvHiL/5GapoDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 13:06:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bKYZMP5GNKSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 13:07:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<RZ2eMf5GLoNA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:07:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<HvIRNP5GLK0DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 13:07:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<J97vMf5GivB100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 28 13:07:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<owH1Mv5Gjs4D7r/l>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:08:18 host2 sshd[3311672]: Disconnected from invalid user ftpuser 103.26.136.173 port 43886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:08:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jFfGNv5GJoEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.153.206
country_id: 6252001
description:
Dec 28 13:08:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.84.153.206, lip=66.85.158.92, session=<tzH0N/5G+KkUVJnO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:10:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<nUzgPv5G3pIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:11:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+b3uP/5GIM8DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:11:41 host2 sshd[3315116]: Disconnected from invalid user ubuntu 103.26.136.173 port 56116 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:13:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<QE6XSf5GSuMDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 13:14:24 host2 sshd[3318293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Dec 28 13:14:12 host2 pure-ftpd[3318138]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:14:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<MkN6TP5GSo4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:14:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sKePTf5Gir4jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 217.172.189.13 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 13:16:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<t0K+VP5GvM6nrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 13:16:13 host2 sshd[3319879]: Disconnected from invalid user 1234 62.60.131.157 port 8631 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2025-12-28 13:16:27 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:45666: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 13:18:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<aWNiWf5GKopnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 13:19:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<PX0kXv5GjKGElEgp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.9
country_id: 2264397
description:
Dec 28 13:19:56 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.9, lip=66.85.158.91, session=<2TNiX/5Gs9xtadEJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.7
country_id: 2264397
description:
Dec 28 13:19:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.209.7, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5vtqX/5GjtptadEH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.10
country_id: 2264397
description:
Dec 28 13:20:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=109.105.209.10, lip=66.85.158.91, TLS, session=<7BKdX/5GCcRtadEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.8
country_id: 2264397
description:
Dec 28 13:20:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.209.8, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<8eLqX/5G/b9tadEI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 13:20:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<pXb9X/5GBosv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 13:22:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<X5X5Zv5GpNYuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 28 13:22:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<F9ipZ/5G8genXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-28 13:23:58 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:48126: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 13:26:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EdFkd/5GprEzTcpt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 28 13:27:16 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS, session=<njSoef5Gj8K594lR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-28 13:29:43 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:57240: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-28 13:29:47 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:32790: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2025-12-28 13:29:55 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:36458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-28 13:29:14 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:63156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 13:30:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<s4oNhP5GsumnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 13:30:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QT+RhP5GJN0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 13:31:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<crOziP5GoN0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 13:31:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jgWxiP5GVBJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 13:31:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<T9zvh/5G4p2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 13:33:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=</Bp5jv5G5OrBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 13:36:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QQgAmf5GYMSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:36:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1jIkm/5GNrYv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 13:37:59 host2 pure-ftpd[3336147]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-28 13:40:02 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:47246: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-28 13:39:49 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:57736: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 28 13:41:24 host2 pure-ftpd[3339161]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-28 13:42:39 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:4884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-28 13:42:55 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:42736: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 13:43:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<4i/Js/5G/Msv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 28 13:43:24 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<C7BNs/5GLJU2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-28 13:45:18 dovecot_login authenticator failed for H=(bVVwC7Il) [69.5.189.21]:62198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-28 13:46:15 dovecot_login authenticator failed for H=(F5vGDJC) [69.5.189.21]:54475: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 13:48:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<sgTfxP5GFKcFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-28 13:49:11 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:33192: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.27
country_id: 3469034
description:
Dec 28 13:49:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=138.36.202.27, lip=66.85.158.91, TLS, session=</tv6xv5GAMSKJMob>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.84.115.34
country_id: 3469034
description:
Dec 28 13:49:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=189.84.115.34, lip=66.85.158.91, TLS, session=<WiO8yP5GCBC9VHMi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 13:49:40 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52508: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 13:50:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jbzrzf5GxIVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:54:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iw012/5GNtwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 13:54:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<sqlF2/5GHMEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.231
country_id: 3175395
description:
Dec 28 13:54:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.15.170.231, lip=66.85.158.91, TLS, session=<k1aL2v5GlqC5D6rn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:54:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<AGVd3P5GznYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 13:55:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<sjTD3P5GuOQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.19.188
country_id: 1269750
description:
Dec 28 13:55:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=103.164.19.188, lip=66.85.158.91, TLS, session=<u43y2/5GMYtnpBO8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 13:56:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<6R6H4/5GKoml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 14:01:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WNye8v5GrCSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 14:01:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<QKiJ8v5GDuukXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-28 14:02:49 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:41418: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 14:03:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zP1S+/5GXkx100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 14:05:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<wj+aAP9GgF6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 14:09:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SJcMD/9GBOwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 14:09:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<l6gZEf9GRoxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 14:12:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53569: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 14:12:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<0OlVHP9GAt1nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-28 14:13:21 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:46381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-28 14:13:36 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:35404: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.127.36.21
country_id: 2395170
description:
Dec 28 14:14:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=154.127.36.21, lip=66.85.158.91, TLS, session=<i6HqIf9G44iafyQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 14:14:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rPqHI/9GgL6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.14
country_id: 798544
description:
Dec 28 14:14:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.231.121.14, lip=66.85.158.91, TLS, session=<njsiI/9GxpVb53kO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 14:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<tU2bJ/9GAt0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 14:15:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yNtgJf9Gls8uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-28 14:15:24 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (ruerativer) [68.40.189.43]:56200: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 14:18:39 host2 sshd[3369621]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 14:18:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<lfWTL/9G/OlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 14:19:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<rdvBM/9GzoaElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 14:20:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8yYKOP9GDsgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 14:23:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<8VjjQf9GaJ2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 14:24:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<zKuFRf9G3ugzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 14:24:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8IEpR/9GIwZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 14:25:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sHnvSv9GBNAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 14:26:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Fkn5Tf9GysenrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.98
country_id: 6252001
description:
Dec 28 14:30:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7uBYXP9GptfG6xhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 14:30:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<2HVpXP9G8Ogv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 14:30:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<b8IxW/9GFqbBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 14:33:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<l/PbZv9GeqCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 14:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sT1Sdv9Gir4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-28 14:39:14 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:60782: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 14:40:57 host2 pure-ftpd[3388228]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-28 14:41:49 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48532: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:42:50 host2 sshd[3389963]: Disconnected from invalid user ftpuser 188.166.156.169 port 40500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-28 14:42:34 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:57642: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 14:44:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ywxKjf9G4NYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:45:43 host2 sshd[3392849]: Disconnected from invalid user user 152.32.131.195 port 43334 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:45:45 host2 sshd[3392880]: Received disconnect from 188.166.156.169 port 41270:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-12-28 14:46:37 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:10834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 14:46:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jQWJlf9GpLRo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:47:10 host2 sshd[3394036]: Disconnected from invalid user ubuntu 188.166.156.169 port 55312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-28 14:47:22 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:49874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:47:25 host2 sshd[3394218]: Disconnected from invalid user new 152.32.131.195 port 43832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 14:48:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<sMhAnf9G4twv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.250.76
country_id: 6252001
description:
[2025-12-28 14:49:48 +0530] info [cpaneld] 97.242.250.76 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.38.152
country_id: 6252001
description:
[2025-12-28 14:49:52 +0530] info [cpaneld] 73.116.38.152 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.114.249
country_id: 6252001
description:
[2025-12-28 14:49:58 +0530] info [cpaneld] 75.207.114.249 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.218.67.54
country_id: 6252001
description:
[2025-12-28 14:49:59 +0530] info [cpaneld] 67.218.67.54 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.27.255.79
country_id: 6252001
description:
[2025-12-28 14:50:04 +0530] info [cpaneld] 199.27.255.79 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.217.112.114
country_id: 6252001
description:
[2025-12-28 14:49:45 +0530] info [cpaneld] 72.217.112.114 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.23.120.159
country_id: 6252001
description:
[2025-12-28 14:49:49 +0530] info [whostmgrd] 45.23.120.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.185.228
country_id: 6252001
description:
[2025-12-28 14:49:56 +0530] info [cpaneld] 96.241.185.228 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.192.67.4
country_id: 6252001
description:
[2025-12-28 14:49:55 +0530] info [cpaneld] 107.192.67.4 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.224.173
country_id: 6252001
description:
[2025-12-28 14:49:57 +0530] info [cpaneld] 65.34.224.173 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:49:45 host2 sshd[3396636]: Disconnected from invalid user es 152.32.131.195 port 34756 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.44.147.199
country_id: 6252001
description:
[2025-12-28 14:49:46 +0530] info [cpaneld] 108.44.147.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 14:49:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MN3pnv9GiMojupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.193.205.225
country_id: 6252001
description:
[2025-12-28 14:50:08 +0530] info [cpaneld] 141.193.205.225 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.38.216
country_id: 6252001
description:
[2025-12-28 14:50:09 +0530] info [cpaneld] 73.231.38.216 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.234.148.42
country_id: 6252001
description:
[2025-12-28 14:50:13 +0530] info [cpaneld] 68.234.148.42 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:50:40 host2 sshd[3397628]: Disconnected from invalid user ftpuser 172.191.239.155 port 42690 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 14:51:22 host2 sshd[3398123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 14:51:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ChP2pf9Gdqul6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:52:28 host2 sshd[3398965]: Disconnected from invalid user tan 172.191.239.155 port 45998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.208.140
country_id: 3144096
description:
2025-12-28 14:52:36 dovecot_login authenticator failed for H=(cm-84.210.208.140.get.no) [84.210.208.140]:47377: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:52:44 host2 sshd[3399188]: Disconnected from invalid user it 209.15.115.240 port 52524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:53:25 host2 sshd[3399721]: Disconnected from invalid user fw 36.95.194.52 port 47144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 14:53:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<crUArv9GiDCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 14:53:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<FyZyrv9GJMQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 14:54:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<7prgr/9GMMUyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 14:55:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JF2qs/9G6MykXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:55:38 host2 sshd[3401670]: Disconnected from invalid user ubuntu 172.191.239.155 port 46004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:55:48 host2 sshd[3401784]: Disconnected from invalid user alexis 36.95.194.52 port 35074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:56:15 host2 sshd[3402164]: Disconnected from invalid user alexis 172.191.239.155 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:56:27 host2 sshd[3402287]: Disconnected from invalid user ubuntu 209.15.115.240 port 39628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:57:36 host2 sshd[3403238]: Disconnected from invalid user yang 36.95.194.52 port 47276 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.99.209
country_id: 6252001
description:
[2025-12-28 14:58:15 +0530] info [whostmgrd] 71.202.99.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.24.104.12
country_id: 6252001
description:
[2025-12-28 14:58:13 +0530] info [cpaneld] 136.24.104.12 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.66.54.58
country_id: 6252001
description:
[2025-12-28 14:58:17 +0530] info [cpaneld] 75.66.54.58 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.217.235.50
country_id: 6252001
description:
[2025-12-28 14:58:19 +0530] info [cpaneld] 97.217.235.50 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.60.161.123
country_id: 6252001
description:
[2025-12-28 14:58:11 +0530] info [cpaneld] 96.60.161.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.239.108.97
country_id: 6252001
description:
[2025-12-28 14:58:18 +0530] info [cpaneld] 162.239.108.97 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.214.65.177
country_id: 6252001
description:
[2025-12-28 14:58:27 +0530] info [cpaneld] 65.214.65.177 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 28 14:58:33 host2 sshd[3404329]: Disconnected from invalid user deploy 43.155.21.198 port 34206 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.113.159.177
country_id: 6252001
description:
[2025-12-28 14:58:12 +0530] info [cpaneld] 207.113.159.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.104.121.203
country_id: 6252001
description:
[2025-12-28 14:58:21 +0530] info [cpaneld] 72.104.121.203 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.75.209.104
country_id: 6252001
description:
[2025-12-28 14:58:23 +0530] info [cpaneld] 12.75.209.104 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.28.82.171
country_id: 6252001
description:
[2025-12-28 14:58:24 +0530] info [cpaneld] 108.28.82.171 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.14
country_id: 6252001
description:
[2025-12-28 14:58:26 +0530] info [cpaneld] 172.58.212.14 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.47.155.83
country_id: 6252001
description:
[2025-12-28 14:58:28 +0530] info [cpaneld] 24.47.155.83 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.72.53.207
country_id: 6252001
description:
[2025-12-28 14:58:20 +0530] info [cpaneld] 173.72.53.207 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 14:59:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<0Q0nxP9GBG+i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:59:32 host2 sshd[3405197]: Disconnected from invalid user ftpuser 209.15.115.240 port 56194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:00:41 host2 sshd[3406271]: Disconnected from invalid user ubuntu 190.153.249.99 port 36946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:00:43 host2 sshd[3406301]: Disconnected from invalid user frontend 161.132.89.53 port 40296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 28 15:01:04 host2 sshd[3406503]: Disconnected from invalid user admin 43.155.21.198 port 34132 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 15:02:21 host2 sshd[3407733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:02:39 host2 sshd[3408062]: Disconnected from invalid user newuser 161.132.89.53 port 48668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:04:00 host2 sshd[3409445]: Disconnected from invalid user postfixtester 190.153.249.99 port 38603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:04:06 host2 sshd[3409538]: Disconnected from invalid user rapid 103.226.139.139 port 48568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:03:15 host2 sshd[3408806]: Disconnected from invalid user xm 161.132.89.53 port 60854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:03:24 host2 sshd[3408982]: Disconnected from invalid user user2 190.153.249.99 port 60860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:03:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RNa50f9GuGEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:03:43 host2 sshd[3409234]: Disconnected from invalid user test6 137.184.30.179 port 34092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:04:11 host2 sshd[3409628]: Disconnected from invalid user ubuntu 137.184.30.179 port 44392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-28 15:05:28 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:48992: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:05:34 host2 sshd[3410832]: Disconnected from invalid user java 103.226.139.139 port 45990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:05:37 host2 sshd[3410922]: Disconnected from invalid user loki 137.184.30.179 port 60078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2025-12-28 15:05:45 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:48096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Dec 28 15:05:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.238, lip=66.85.158.92, TLS, session=<iBqX1/9G/PjG6xju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:05:09 host2 sshd[3410539]: Disconnected from invalid user misp 137.184.30.179 port 59256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:06:32 host2 sshd[3411576]: Disconnected from invalid user hostinger 137.184.30.179 port 50354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 15:06:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+waM3f9GWqVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 15:08:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<kTEZ5f9GpMsuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.175
country_id: 3469034
description:
Dec 28 15:09:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=191.53.129.175, lip=66.85.158.91, TLS, session=<1L/55f9GnaO/NYGv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:09:47 host2 sshd[3414144]: Disconnected from invalid user db2fenc1 103.226.139.139 port 38260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.125
country_id: 3865483
description:
Dec 28 15:09:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=179.0.251.125, lip=66.85.158.91, TLS, session=<EGVO5/9G9uSzAPt9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 15:12:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ez7a8f9GypdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 15:12:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<iiRB8v9G+sMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 15:13:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IWHo8/9GAqSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.12.118.74
country_id: 3469034
description:
Dec 28 15:13:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.12.118.74, lip=66.85.158.91, TLS, session=<9pOV9P9GALexDHZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 28 15:14:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<faOt+f9GkpEDWgzA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 28 15:14:55 host2 pure-ftpd[3418771]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 15:15:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<b5XF/P9G3pYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 15:15:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3njd/P9GHMSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 15:18:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yJAECABHnA5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 15:18:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<sMrKCABHBNaElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 15:19:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<iLacCgBHiqEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 15:20:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GiGKDQBH2MIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 15:22:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<jHYnFQBH+KinrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 15:25:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SGncHwBHNLQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 15:28:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 14 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<2+C8KABHqMbBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 15:32:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<LIkqOABHnIunrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 15:32:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<eDm4OABHhLAv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.248.95
country_id: 2510769
description:
2025-12-28 15:32:43 dovecot_login authenticator failed for H=95.82-130-248.dynamic.clientes.euskaltel.es [82.130.248.95]:55602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 15:40:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<iv28VgBHFOsFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 15:42:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</stwXABH3GFo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 15:43:34 host2 pure-ftpd[3447850]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:43:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jdznYQBHfoYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 15:43:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DB/bYQBHNM0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 15:45:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<DeyiaABH6LWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 15:45:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<W3HuZwBHNIil6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.199.25
country_id: 6252001
description:
Dec 28 15:46:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.182.199.25, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Vbe0bABHXJKTtscZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.14
country_id: 2186224
description:
2025-12-28 15:47:35 dovecot_login authenticator failed for H=([121.73.163.14]) [121.73.163.14]:44656: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-28 15:48:02 dovecot_login authenticator failed for H=([201.166.222.48]) [201.166.222.48]:35397: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 15:48:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<T3/AcQBHhrCkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-28 15:49:16 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:48150: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.219
country_id: 1269750
description:
Dec 28 15:48:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.219, lip=66.85.158.91, TLS, session=<V3yNcQBHZ8JnpPbb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.8.13
country_id: 2300660
description:
Dec 28 15:48:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.8.13, lip=66.85.158.91, TLS, session=<56K7cgBHDcgpiwgN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-28 15:49:58 dovecot_login authenticator failed for H=([222.124.249.132]) [203.130.212.59]:52096: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 28 15:51:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<6zCDewBHaoAFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:51:04 host2 sshd[3454006]: Disconnected from invalid user dev 189.178.26.161 port 56532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:53:09 host2 sshd[3455501]: Disconnected from invalid user mani 189.178.26.161 port 33618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:53:18 host2 sshd[3455588]: Disconnected from invalid user es 154.83.15.200 port 43700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:52:30 host2 sshd[3454949]: Disconnected from invalid user debian 189.178.26.161 port 49314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 15:52:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<xoSogQBH/qMvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 15:54:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<GWdzhgBH8MOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 15:54:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gvyehgBH6zB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 15:53:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<SKMDhQBHRtgyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:54:36 host2 sshd[3456827]: Disconnected from invalid user forward 154.83.15.200 port 41204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:55:48 host2 sshd[3457752]: Disconnected from invalid user newroot 154.83.15.200 port 38700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:55:30 host2 sshd[3457595]: Disconnected from invalid user admin 189.178.26.161 port 55546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:58:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<g9g1lQBH7kYjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 28 15:59:17 host2 sshd[3460172]: Disconnected from invalid user monika 15.235.162.8 port 39860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 16:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<UYOVngBHtudnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 16:02:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<CcYDpQBHRNYuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 16:06:48 host2 sshd[3466336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 16:08:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<my73uABHqLSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 16:09:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Fb2uvABHsKQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-28 16:09:38 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:53720: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-28 16:10:26 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:54803: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 16:11:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Cv0YxgBH7qxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 16:12:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<kj4lyABHjoIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 16:12:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YkXxyABH0jhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 16:12:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<JOzpyABH5tynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 16:14:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<lqDB0ABHALAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 16:16:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<nN1A1gBHDrQzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 82.223.28.152 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 16:18:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</Aw93gBH0raElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 16:18:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<AHn83gBHaqOnrEV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2025-12-28 16:19:07 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:54200: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 16:19:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<OUMG4QBHWrRA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-28 16:20:33 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48993: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 16:20:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GUob5gBHrMkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 28 16:20:57 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<pGnI5gBHoJMD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 28 16:22:49 host2 sshd[3479839]: Disconnected from invalid user alex 50.84.211.204 port 60162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 28 16:24:11 host2 sshd[3481153]: Disconnected from invalid user ts 50.84.211.204 port 32996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 16:27:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<y06t/ABHFp0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:30:23 host2 sshd[3486366]: Disconnected from invalid user spooler 192.3.105.24 port 48268 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:31:56 host2 sshd[3487413]: Received disconnect from 192.3.105.24 port 48394:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:32:13 host2 sshd[3487626]: Disconnected from invalid user deploy 43.166.245.172 port 17152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 28 16:31:52 host2 sshd[3487352]: Disconnected from invalid user amit 186.248.197.77 port 64084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 16:32:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bbj4EAFHmMmnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:33:02 host2 sshd[3488156]: Disconnected from invalid user marina 192.3.105.24 port 48472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 28 16:33:31 host2 sshd[3488425]: Disconnected from invalid user raaj 101.47.143.252 port 46818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:33:54 host2 sshd[3488708]: Disconnected from invalid user ftpuser 43.166.245.172 port 11776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:34:33 host2 sshd[3489444]: Disconnected from invalid user raaj 192.3.105.24 port 48600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 28 16:35:43 host2 sshd[3490398]: Disconnected from invalid user cluster 101.47.143.252 port 41072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 16:36:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3zyfHgFHvNYFhXlo>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:36:53 host2 sshd[3491333]: Received disconnect from 43.166.245.172 port 17153:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 16:38:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<h7KmJQFH/uFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 16:38:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d9w6JgFHflEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 16:39:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cLxcKQFHzqUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 16:39:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<MghgKQFH/qml6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-28 16:40:40 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:39922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-28 16:41:22 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:44660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 16:46:20 host2 pure-ftpd[3498895]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 16:48:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<j1g7SQFHSHmi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 16:50:34 host2 sshd[3502196]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 16:50:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<JEPrUQFH/Y9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.237
country_id: 953987
description:
Dec 28 16:50:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=102.129.54.237, lip=66.85.158.91, TLS, session=<EqXJUAFHuIBmgTbt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.61.202.27
country_id: 2510769
description:
Dec 28 16:50:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=5.61.202.27, lip=66.85.158.91, TLS, session=<N8GqTwFHPugFPcob>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-28 16:52:54 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:60944: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 16:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kydsWQFHuHIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 16:53:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Bow5WgFHOIcvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-28 16:53:18 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:49768: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 16:54:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<0lrmXQFHwoIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 28 16:55:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<dZ/gYAFHssQFhH+s>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.14.57.155
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.14.57.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.134.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.10.134.25 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.32.234
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.189.32.234 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 16:55:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9xmrYQFHXuNnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-28 16:56:12 dovecot_login authenticator failed for H=([122.185.152.72]) [122.187.222.54]:58516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.54.129.105
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.54.129.105 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.33.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 98.97.33.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.71.120.49
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 198.71.120.49 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.248
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.189.248 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.250.226.32
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.250.226.32 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.140.216.246
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.140.216.246 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-28 16:56:33 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:43282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 16:56:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<zkccZgFHrtsuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.242.132.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.242.132.82 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.75.126
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 100.0.75.126 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.57.77
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.37.57.77 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.237.22.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 167.237.22.137 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.40.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.105.40.17 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 16:59:27 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47539: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 28 16:59:28 host2 sshd[3510027]: Disconnected from invalid user server 195.178.191.5 port 59336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 17:00:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<TCVVdAFHLsai8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 28 17:02:12 host2 sshd[3512539]: Disconnected from invalid user tempuser 195.178.191.5 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:01:54 host2 sshd[3512266]: Disconnected from invalid user abhi 185.121.0.2 port 56006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:02:32 host2 sshd[3512812]: Disconnected from invalid user user22 185.121.0.2 port 51346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:03:45 host2 sshd[3513934]: Disconnected from invalid user sajjad 185.121.0.2 port 36190 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:04:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hwi/gAFHxo0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 28 17:03:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FM/RfwFH/kBChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:04:20 host2 sshd[3514624]: Disconnected from invalid user esuser 185.121.0.2 port 36948 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:04:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ujd7ggFHRpkDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:05:31 host2 sshd[3515802]: Disconnected from invalid user student2 185.121.0.2 port 45186 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:05:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2TrBhgFHJLADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:06:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LcAviQFHKpcDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 17:06:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vkO+igFHEIUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 17:06:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YnDJigFHYhpniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:07:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<Esu3jgFH9t4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 17:08:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Sbk6kAFHMMlA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:08:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<7hpMkQFHnNsDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 17:09:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bIyulQFHtpwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 17:10:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yXtPlgFHTOEzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:09:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5E1FlAFHMI0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-28 17:10:43 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:58586: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:10:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<idf3lwFHEIsDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-28 17:11:26 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:57899: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-28 17:11:59 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:37472: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 17:14:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<nIsrpQFHPJ6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 17:14:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+f61pAFH9pEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 17:14:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<KAftpQFH9MPJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 17:15:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<RUL4qAFHDO6nrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 17:15:34 host2 sshd[3524398]: Disconnected from invalid user ubnt 62.60.131.157 port 43725 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 17:16:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wQjUqwFHKp9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.137
country_id: 732800
description:
Dec 28 17:16:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.255.212.137, lip=66.85.158.91, TLS, session=<4jfxqgFHepK5/9SJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.111
country_id: 3469034
description:
Dec 28 17:16:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=186.224.97.111, lip=66.85.158.91, TLS, session=<tvYdrAFHMdi64GFv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-28 17:16:53 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:52650: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-28 17:17:33 dovecot_login authenticator failed for H=([222.124.249.132]) [203.130.212.59]:53610: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 17:17:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<goSMsQFHvuAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 17:19:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<wDDItwFH8peElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-28 17:19:32 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:40134: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2025-12-28 17:19:23 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:38233: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-28 17:20:22 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:45798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 17:22:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<x5TFwQFHKIov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.226.3.22
country_id: 2464461
description:
2025-12-28 17:21:51 dovecot_login authenticator failed for H=([41.226.3.22]) [41.226.3.22]:54035: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-28 17:23:06 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:37015: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-28 17:23:18 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:45760: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-28 17:22:19 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:34690: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.25
country_id: 2186224
description:
2025-12-28 17:22:43 dovecot_login authenticator failed for H=([121.73.162.25]) [121.73.162.25]:58140: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-28 17:22:45 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:40230: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2025-12-28 17:22:59 dovecot_login authenticator failed for H=([103.184.155.242]) [103.184.155.242]:58714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-28 17:23:40 dovecot_login authenticator failed for H=([189.109.154.54]) [189.109.154.54]:50646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-28 17:24:12 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:55548: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.209
country_id: 690791
description:
2025-12-28 17:23:32 H=([77.83.39.209]) [77.83.39.209]:61047 F=<dpr@priv8shop.com> rejected RCPT <davebruce06@outlook.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-28 17:24:38 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:54644: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2025-12-28 17:27:15 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:57999: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-28 17:27:40 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:35522: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.9.129
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.248.9.129 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 17:32:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<+K7c5wFHyOEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 17:33:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<x//G6wFHHJGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 17:33:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ofxc6gFHnJMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 17:33:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<E04I6wFHTo6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 17:34:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cSo37gFH0DFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 17:36:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<whcd9AFHcNsv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 28 17:37:16 host2 sshd[3542488]: Disconnected from invalid user neo4j 209.141.62.124 port 40578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 28 17:38:11 host2 sshd[3543191]: Disconnected from invalid user linkdood 209.141.62.124 port 52602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 28 17:37:36 host2 sshd[3542755]: Disconnected from invalid user ws 51.195.138.37 port 44462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 28 17:38:57 host2 sshd[3543960]: Disconnected from invalid user lighthouse 36.89.28.139 port 42306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 28 17:40:01 host2 sshd[3544788]: Disconnected from invalid user ubuntu 51.195.138.37 port 36698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-28 17:40:54 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:44616: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-28 17:40:21 dovecot_login authenticator failed for H=([189.218.82.49]) [189.218.82.49]:39243: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 28 17:40:29 host2 sshd[3545512]: Received disconnect from 51.195.138.37 port 57328:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 28 17:40:29 host2 sshd[3545512]: Disconnected from invalid user roo 51.195.138.37 port 57328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Dec 28 17:41:56 host2 sshd[3546721]: Disconnected from invalid user linkdood 36.89.28.139 port 59328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 17:42:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<GXd5CgJHoCii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 17:44:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<DwReEAJHT69100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.209
country_id: 2658434
description:
Dec 28 17:46:23 host2 sshd[3550901]: Disconnected from invalid user server 185.196.8.209 port 39564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 28 17:46:49 host2 sshd[3551196]: Disconnected from invalid user administrator 79.168.139.28 port 59846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.209
country_id: 2658434
description:
Dec 28 17:47:30 host2 sshd[3551741]: Disconnected from invalid user uftp 185.196.8.209 port 42922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 17:48:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<asrwHQJHEG4jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 28 17:48:25 host2 sshd[3552488]: Disconnected from invalid user william 79.168.139.28 port 38658 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.196.8.209
country_id: 2658434
description:
Dec 28 17:48:42 host2 sshd[3552602]: Received disconnect from 185.196.8.209 port 59166:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.209
country_id: 2658434
description:
Dec 28 17:48:42 host2 sshd[3552602]: Disconnected from invalid user webuser 185.196.8.209 port 59166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 17:49:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qNCMIgJHQqBnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 17:49:38 host2 pure-ftpd[3553242]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 17:50:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<J9xYJQJHxtwuZXpm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 28 17:50:28 host2 sshd[3553837]: Disconnected from invalid user lily 79.168.139.28 port 41920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 17:51:37 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52956: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 17:52:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mfQYLgJHkMii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 17:53:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<adEXMgJH1NcvWBNS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 17:55:04 host2 sshd[3557072]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 17:54:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<6IOdNQJHtr0yBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 28 17:55:18 host2 sshd[3557307]: Disconnected from invalid user ubuntu 139.59.43.242 port 57806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 28 17:56:30 host2 sshd[3558404]: Disconnected from invalid user root6 139.59.43.242 port 38636 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.0
country_id: 798549
description:
Dec 28 17:57:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.0, lip=66.85.158.92, TLS: Connection closed, session=<CkLjPwJH0qFV2ZUA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.0
country_id: 798549
description:
Dec 28 17:59:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.0, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OmQGRgJHuoJV2ZUA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.66.2.184
country_id: 390903
description:
2025-12-28 17:59:45 dovecot_login authenticator failed for H=orz58h.static.otenet.gr [94.66.2.184]:35828: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2025-12-28 18:00:02 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:50020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-28 18:00:38 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:49828: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 18:00:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GABGSwJHAkVniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-28 18:01:04 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:58002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.221.142.137
country_id: 690791
description:
Dec 28 18:01:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=37.221.142.137, lip=66.85.158.91, TLS, session=<mlGjTAJHp90l3Y6J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.176
country_id: 798544
description:
Dec 28 18:01:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=46.20.58.176, lip=66.85.158.91, TLS, session=<otbTTQJH+ssuFDqw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 18:05:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<hDyRWwJHQqZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 18:05:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<LV/4WwJHktQv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 18:05:25 host2 sshd[3565476]: Disconnected from invalid user user 62.60.131.157 port 55726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 18:05:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bpxLXAJHbIkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.93.108
country_id: 357994
description:
2025-12-28 18:06:58 dovecot_login authenticator failed for H=([196.219.93.108]) [196.219.93.108]:45504: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-28 18:07:13 dovecot_login authenticator failed for H=(nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:50108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 18:07:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<OVymYwJHpMozTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-28 18:08:41 dovecot_plain authenticator failed for H=(uptomp) [81.181.129.131]:23474: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-28 18:09:27 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (unche) [71.230.228.16]:56318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 18:14:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Mg/fewJHBMGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 18:17:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<oVOBiAJHjuUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 18:19:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<LrfzjAJHKOeElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.243.168
country_id: 2464461
description:
2025-12-28 18:23:27 dovecot_plain authenticator failed for H=(Z69Q27X) [196.203.243.168]:55869: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-12-28 18:24:27 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:34056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-28 18:24:28 dovecot_login authenticator failed for H=([82.102.158.36]) [82.102.158.36]:60424: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.167
country_id: 3996063
description:
2025-12-28 18:23:55 dovecot_login authenticator failed for H=(201.173.216.167-clientes-izzi.mx) [201.173.216.167]:37523: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-12-28 18:24:05 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:52580: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-28 18:24:22 dovecot_login authenticator failed for H=([27.123.113.10]) [27.123.113.10]:39902: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-28 18:25:19 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:55498: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-28 18:25:31 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:48746: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-28 18:26:04 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:44814: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 5.61.202.18
country_id: 2510769
description:
Dec 28 18:26:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=5.61.202.18, lip=66.85.158.91, TLS, session=<27KdpgJH0ZgFPcoS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-28 18:26:37 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12179: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-28 18:25:48 dovecot_login authenticator failed for H=(dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:41540: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.141
country_id: 3144096
description:
2025-12-28 18:26:46 dovecot_login authenticator failed for H=(cm-178.232.162.141.get.no) [178.232.162.141]:34572: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.58
country_id: 1269750
description:
Dec 28 18:26:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.109.178.58, lip=66.85.158.91, TLS, session=<EZO8pwJHy9VnbbI6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-28 18:26:53 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:54843: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-12-28 18:27:07 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [102.132.29.166]:49705: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.87.21
country_id: 2921044
description:
Dec 28 18:27:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.87.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Cv4mqgJHwiSGelcV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 18:27:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.71.87, lip=66.85.158.92, TLS, session=<sUThqwJH/qul6EdX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 18:27:42 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.232.71.87, lip=66.85.158.92, session=<ErgKrAJHQqyl6EdX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 18:27:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GRvarAJHoNCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 18:28:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<n40CsAJHnscjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 18:29:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IFuusgJH7Bpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 18:29:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mDTFswJHZIQFhXlo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.206.87
country_id: 6252001
description:
Dec 28 18:32:10 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=152.32.206.87, lip=66.85.158.92, TLS, session=<3w0HvAJHtuaYIM5X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.206.87
country_id: 6252001
description:
Dec 28 18:32:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.206.87, lip=66.85.158.92, session=<Pw4BvAJH4uWYIM5X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 18:32:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<un2BvAJHkNAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 18:34:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tnedwgJHpNGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 18:36:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OjedzAJH7hCi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 18:38:55 host2 sshd[3594180]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 18:42:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ye6X4QJHub9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 18:43:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<glrz4wJHLOsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 18:43:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<bds85AJHINcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 18:43:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6PNU5AJHutpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 18:44:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<V6Z86AJHKOii8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 186.124.218.159
country_id: 3865483
description:
Dec 28 18:46:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=186.124.218.159, lip=66.85.158.91, TLS, session=<QqXr7gJHlou6fNqf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.80
country_id: 3469034
description:
Dec 28 18:47:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.131.80, lip=66.85.158.91, TLS, session=<+ClM8AJHUtm/NYNQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2025-12-28 18:51:35 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:38174: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-12-28 18:51:57 dovecot_login authenticator failed for H=(189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:36347: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-28 18:53:04 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:47944: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 18:53:53 host2 sshd[3609861]: Disconnected from invalid user user 62.60.131.157 port 36706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.76.21.195
country_id: 6251999
description:
2025-12-28 18:54:27 dovecot_login authenticator failed for H=(195-cpe.arris.avetria.ca) [208.76.21.195]:47541: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-12-28 18:54:38 dovecot_login authenticator failed for H=([178.158.235.131]) [178.158.235.131]:35590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 18:53:41 host2 pure-ftpd[3609723]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-28 18:55:09 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [136.232.73.130]:53294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.37.198.190
country_id: 6252001
description:
2025-12-28 18:55:22 dovecot_login authenticator failed for H=(host190.covisint.com) [64.37.198.190]:63130: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 28 18:54:42 host2 pure-ftpd[3611035]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 18:54:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dLG6DANHKiVniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-28 18:54:47 dovecot_login authenticator failed for H=([182.95.20.31]) [182.95.228.22]:60660: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 18:54:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=</3LwDANH3rovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2025-12-28 18:54:59 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:49650: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 18:56:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ci4jEgNHfMcyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Dec 28 18:59:48 host2 sshd[3616501]: Disconnected from invalid user dev 95.58.255.251 port 43636 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 28 18:59:57 host2 pure-ftpd[3616670]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 28 19:00:03 host2 pure-ftpd[3616952]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 28 19:00:42 host2 pure-ftpd[3617755]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 28 19:00:43 host2 pure-ftpd[3617786]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.58.255.251
country_id: 1522867
description:
Dec 28 19:01:00 host2 sshd[3618097]: Disconnected from invalid user lenovo 95.58.255.251 port 60238 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-28 19:02:02 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Dec 28 19:02:11 host2 sshd[3619383]: Disconnected from invalid user mutua 95.58.255.251 port 58308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 19:01:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7f3JJQNHFugv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 19:04:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<pmPiLQNHSMJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 19:04:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<meiWLgNHLrwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 19:04:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<FohnMANHTuMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 19:08:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<SNDIPQNHPOqnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 19:08:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<CQ1ePgNHYrEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 19:10:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+MR1QwNHtN4v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 19:11:07 host2 sshd[3628517]: Disconnected from invalid user user 62.60.131.157 port 46382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-28 19:12:18 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:44672: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 19:11:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<bHGCSQNHHtBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-28 19:12:42 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:56716: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 19:14:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<AfOrUgNHRtcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 19:15:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<hbtlVwNHzsynrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.76.91.36
country_id: 1861060
description:
2025-12-28 19:16:07 dovecot_login authenticator failed for H=ab091036.ppp.asahi-net.or.jp [183.76.91.36]:46015: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 19:18:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<LFrrYgNHEsiElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.167
country_id: 1269750
description:
Dec 28 19:22:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.172.11.167, lip=66.85.158.91, TLS, session=<iIANbwNHr+BnrAun>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-28 19:22:34 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:51750: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 19:21:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<S9BabQNHaMOl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2025-12-28 19:21:49 dovecot_login authenticator failed for H=([84.215.63.103]) [84.215.63.103]:56492: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.8.118.197
country_id: 1269750
description:
Dec 28 19:22:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.8.118.197, lip=66.85.158.91, TLS, session=<66PHbQNHuMFnCHbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 19:24:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<xqy1dgNHcqwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 19:25:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<05mReQNHzKRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 19:27:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6nlAgQNHdtcFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-28 19:27:57 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:42876: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-28 19:28:16 dovecot_login authenticator failed for H=([195.222.57.182]) [195.222.57.190]:37406: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 19:28:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<fuDhhgNH7K8v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Dec 28 19:29:05 host2 sshd[3642644]: Disconnected from invalid user apagar 144.126.217.19 port 40998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.225.246.102
country_id: 3469034
description:
Dec 28 19:29:51 host2 sshd[3643154]: Disconnected from invalid user master 200.225.246.102 port 55494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Dec 28 19:31:20 host2 sshd[3644878]: Disconnected from invalid user invoices 144.126.217.19 port 39438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.196.237
country_id: 241170
description:
Dec 28 19:31:23 host2 sshd[3644894]: Disconnected from invalid user minecraft 154.83.196.237 port 38952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-28 19:30:42 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (spocia) [87.103.126.54]:63506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.126.217.19
country_id: 6252001
description:
Dec 28 19:32:27 host2 sshd[3645708]: Disconnected from invalid user angular 144.126.217.19 port 51502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 19:31:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qVxQkQNHptyi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Dec 28 19:31:55 host2 sshd[3645348]: Disconnected from invalid user ll 144.126.217.19 port 58060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.217.19
country_id: 6252001
description:
Dec 28 19:32:59 host2 sshd[3646019]: Disconnected from invalid user trac 144.126.217.19 port 60586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 28 19:33:59 host2 sshd[3646668]: Disconnected from invalid user master 172.208.24.217 port 61300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.83.92.51
country_id: 2017370
description:
Dec 28 19:34:48 host2 sshd[3647239]: Disconnected from invalid user fiscal 77.83.92.51 port 48282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.196.237
country_id: 241170
description:
Dec 28 19:35:15 host2 sshd[3647717]: Disconnected from invalid user sshuser 154.83.196.237 port 52684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-28 19:35:48 dovecot_login authenticator failed for H=([182.95.24.117]) [182.95.56.134]:56082: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.92.51
country_id: 2017370
description:
Dec 28 19:35:55 host2 sshd[3648259]: Disconnected from invalid user minecraft 77.83.92.51 port 59534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 19:35:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<r0sLoANHDLOnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-12-28 19:36:02 dovecot_login authenticator failed for H=([121.73.163.19]) [121.73.163.19]:32856: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 19:36:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yicIowNHGtIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 19:37:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<JIvOpQNHyq+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 19:38:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<X7YPqQNHRsFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 19:39:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LGRdqwNHynwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 28 19:39:56 host2 sshd[3651308]: Disconnected from invalid user tecmint 198.12.85.136 port 55158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 19:40:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<VOKbrwNHQjB100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.5.112.39
country_id: 3175395
description:
Dec 28 19:41:42 host2 sshd[3652589]: Disconnected from invalid user ftp_user 151.5.112.39 port 58318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 28 19:42:57 host2 sshd[3653423]: Disconnected from invalid user icp 198.12.85.136 port 48900 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 19:43:45 host2 sshd[3654121]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2025-12-28 19:45:05 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:42369: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-28 19:45:06 dovecot_login authenticator failed for H=(cm-178.232.201.31.get.no) [178.232.201.31]:53103: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 28 19:45:07 host2 sshd[3655608]: Disconnected from invalid user admin 198.12.85.136 port 52274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-28 19:45:19 dovecot_login authenticator failed for H=([114.9.22.30]) [114.9.22.30]:47389: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.243.30
country_id: 1269750
description:
2025-12-28 19:44:44 dovecot_login authenticator failed for H=([125.16.185.97]) [152.52.243.30]:35068: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 28 19:46:08 host2 sshd[3656322]: Disconnected from invalid user user 198.12.85.136 port 60542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 28 19:45:49 host2 sshd[3656097]: Disconnected from invalid user Rizve 132.248.55.4 port 10137 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 28 19:47:00 host2 sshd[3656883]: Disconnected from invalid user deelip 132.248.55.4 port 27805 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 19:49:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yHgrzwNHBwVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.5.112.39
country_id: 3175395
description:
Dec 28 19:50:43 host2 sshd[3660090]: Disconnected from invalid user admin 151.5.112.39 port 48788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Dec 28 19:52:40 host2 sshd[3661325]: Disconnected from invalid user amir 45.78.202.217 port 45476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.5.112.39
country_id: 3175395
description:
Dec 28 19:56:00 host2 sshd[3664763]: Disconnected from invalid user student6 151.5.112.39 port 47088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-28 19:57:06 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:43007: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-28 19:57:20 dovecot_login authenticator failed for H=([182.79.70.81]) [27.123.97.74]:52310: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 19:58:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<JcE47wNHStsv7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 19:57:56 host2 pure-ftpd[3665980]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 19:57:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NlSg7gNHUKIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 19:59:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Hic68wNHnIoyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Dec 28 19:59:08 host2 sshd[3666989]: Disconnected from invalid user szy 103.172.205.103 port 60644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 20:01:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<sC9s+wNHXp0zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 28 20:01:42 host2 sshd[3669254]: Disconnected from invalid user vyatta 122.166.49.42 port 45800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 20:02:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ITw7/QNHnLJA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 28 20:03:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<3OvUAQRHJGRChJmK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 28 20:03:03 host2 sshd[3670166]: Disconnected from invalid user rover 122.166.49.42 port 44084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-28 20:03:43 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:60588: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 20:03:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<K9A2BARHDp0v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2025-12-28 20:04:14 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:41338: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 20:05:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<2U14CQRHLMQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 28 20:05:38 host2 sshd[3672535]: Disconnected from invalid user toto 122.166.49.42 port 40628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 20:05:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<1rahCgRHos2nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 20:06:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<B7+mDQRHGO0v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 28 20:06:57 host2 sshd[3673471]: Disconnected from invalid user ubuntu 122.166.49.42 port 38906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 28 20:08:00 host2 sshd[3674170]: Disconnected from invalid user test 103.49.238.251 port 45994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Dec 28 20:08:30 host2 sshd[3674584]: Disconnected from invalid user rover 103.172.205.103 port 57626 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 28 20:09:37 host2 sshd[3675498]: Disconnected from invalid user toto 103.49.238.251 port 37778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 20:10:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<NSDRGwRHMskv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 20:09:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cXvgGARHyolA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.53.130.6
country_id: 3469034
description:
Dec 28 20:09:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=191.53.130.6, lip=66.85.158.91, TLS, session=<gK6rGARH8MS/NYIG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.214
country_id: 3469034
description:
Dec 28 20:10:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.7.187.214, lip=66.85.158.91, TLS, session=<v3D1GQRH7totB7vW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 28 20:10:27 host2 sshd[3676590]: Disconnected from invalid user useradmin 103.49.238.251 port 54008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec 28 20:11:17 host2 sshd[3677150]: Disconnected from invalid user zhang 103.49.238.251 port 59922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-28 20:12:35 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:36152: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.44.137.178
country_id: 798549
description:
2025-12-28 20:15:09 dovecot_login authenticator failed for H=([89.44.137.178]) [89.44.137.178]:45336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 20:15:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<gBn0LARHNNGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 20:16:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<cc0HMgRHUIGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 20:20:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XZ4FPgRHsCRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 20:19:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</nA4OwRHBKmElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 20:20:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+tMQPwRHfOcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.123
country_id: 3865483
description:
Dec 28 20:23:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.238.107.123, lip=66.85.158.91, TLS, session=<XtdoSARHyKst7mt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.57.30
country_id: 3469034
description:
Dec 28 20:23:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=138.117.57.30, lip=66.85.158.91, TLS, session=<yy2mSQRH+w6KdTke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-28 20:23:38 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:49414: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.139
country_id: 2186224
description:
2025-12-28 20:24:26 dovecot_login authenticator failed for H=([121.73.163.139]) [121.73.163.139]:43604: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-28 20:24:09 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:55691: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 20:25:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<fQuRUARHSJgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 20:25:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<U2QPUQRHCsYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-28 20:25:27 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:35894: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 20:27:46 host2 sshd[3689229]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 20:27:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<DIH0VwRHKtai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 20:30:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UN3JZARHEL6i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.178.139
country_id: 3175395
description:
Dec 28 20:30:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.178.139, lip=66.85.158.91, TLS, session=<2f7vYARHYefZGrKL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 20:30:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<N305YgRHlMkuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.221
country_id: 690791
description:
Dec 28 20:30:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.147.221, lip=66.85.158.91, TLS, session=<iYv+YQRHyqEl3ZPd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 20:33:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<HaFJbQRHYOZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 20:35:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<irOhcwRHhE4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 20:36:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<SxHteARHrjx100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 20:36:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Px7HeARHlOinrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 20:43:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<bfTykgRHkQ5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.164
country_id: 2186224
description:
2025-12-28 20:43:31 dovecot_login authenticator failed for H=([121.73.163.164]) [121.73.163.164]:34264: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.113.62
country_id: 1269750
description:
2025-12-28 20:43:51 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.113.62]:45817: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-28 20:47:09 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:30702: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-28 20:47:32 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:53238: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Dec 28 20:47:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<89HPoARH5dEjy9I0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.178.118
country_id: 1269750
description:
2025-12-28 20:49:01 dovecot_login authenticator failed for H=([125.19.178.118]) [125.19.178.118]:42300: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Dec 28 20:48:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<28QUowRHBvgjy9I0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-28 20:48:49 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:42766: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Dec 28 20:49:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<fCcepgRHOO0jy9I0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.7.227.98
country_id: 1269750
description:
Dec 28 20:49:43 host2 sshd[3706628]: Disconnected from invalid user runo 124.7.227.98 port 62876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Dec 28 20:52:11 host2 sshd[3708520]: Disconnected from invalid user opc 124.7.227.98 port 43420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 28 20:52:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ea+gsQRH0ppChJl8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.81
country_id: 6252001
description:
Dec 28 20:53:35 host2 pure-ftpd[3709538]: (?@147.185.132.81) [INFO] New connection from 147.185.132.81


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 20:54:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Fvh4uARHtssv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Dec 28 20:56:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS, session=<zOc5wQRHRPAjy9I0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Dec 28 20:57:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS, session=<j6ChxARH/Ogjy9I0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 20:58:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yanDxwRHoowzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 20:59:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<pccDywRHkNVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 21:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<RVhwzwRHuokvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.234.132.142
country_id: 6290252
description:
Dec 28 21:01:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=91.234.132.142, lip=66.85.158.91, TLS, session=<ZE32zwRHhLhb6oSO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.19
country_id: 953987
description:
Dec 28 21:01:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.32.19, lip=66.85.158.91, TLS, session=<pnAZ0QRHJ4dmQCAT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 21:01:49 host2 pure-ftpd[3716118]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 21:01:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<orW00wRHArqnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 21:02:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<71Tm1QRHGrszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 21:02:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<j/I21wRHbOsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 21:02:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Sjv+1ARHwJ0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 21:03:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Gpxl2ARH+q4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 21:06:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Ayt15QRHALov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.73.76
country_id: 1880251
description:
2025-12-28 21:08:04 dovecot_login authenticator failed for H=([124.197.73.76]) [124.197.73.76]:51679: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 21:07:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<u9Ab5wRH6s1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-28 21:08:14 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:37378: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 21:09:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ygQw7QRHLq2l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.216.213.149
country_id: 933860
description:
Dec 28 21:12:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=41.216.213.149, lip=66.85.158.91, TLS, session=<yFT39wRHmoYp2NWV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.129.28
country_id: 690791
description:
Dec 28 21:13:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.129.28, lip=66.85.158.91, TLS, session=<CjZV+gRHjuYl3YEc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 21:13:16 host2 sshd[3724465]: Disconnected from invalid user administrator 62.60.131.157 port 7026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.60.212.150
country_id: 3175395
description:
Dec 28 21:14:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=194.60.212.150, lip=66.85.158.91, TLS, session=<eRDkAAVHWYbCPNSW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.73
country_id: 798544
description:
Dec 28 21:15:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.216.27.73, lip=66.85.158.91, TLS, session=<zU78AQVHXr6y2BtJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 21:15:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<S5d1AwVHPuZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 21:16:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8TigCAVHgHQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 21:17:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<kf1hCwVHypWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-12-28 21:18:10 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:48722: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.13
country_id: 798549
description:
Dec 28 21:18:28 host2 pure-ftpd[3728932]: (?@212.73.148.13) [INFO] New connection from 212.73.148.13


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 28 21:18:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<zil3EAVHFsDY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.210
country_id: 6252001
description:
Dec 28 21:19:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.210, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pwv+EAVHlxhAPpzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 28 21:19:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, TLS: Connection closed, session=<5bU9EQVHILfY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Dec 28 21:19:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vagLEgVH2kFAPpzK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 21:20:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<5zwSFQVHCIqElEgp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.13
country_id: 798549
description:
Dec 28 21:20:45 host2 pure-ftpd[3730773]: (?@212.73.148.13) [INFO] New connection from 212.73.148.13


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 212.73.148.13
country_id: 798549
description:
Dec 28 21:20:54 host2 pure-ftpd[3730870]: (?@212.73.148.13) [INFO] New connection from 212.73.148.13


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 21:22:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZZE+HAVH0okv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 21:22:29 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52367: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.214.137.125
country_id: 690791
description:
Dec 28 21:22:47 host2 pure-ftpd[3732068]: (?@91.214.137.125) [INFO] New connection from 91.214.137.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 21:23:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mi0ZHwVH1i+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.15.170.217
country_id: 3175395
description:
Dec 28 21:23:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=185.15.170.217, lip=66.85.158.91, TLS, session=<a/XGHwVHkaC5D6rZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.190.204.180
country_id: 3469034
description:
Dec 28 21:23:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.190.204.180, lip=66.85.158.91, TLS, session=<B2LqIAVHqpotvsy0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 21:24:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=</sxgIwVH6rWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 21:24:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1nMjJAVHJtIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 21:24:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<geNHIwVHlokFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-28 21:25:27 dovecot_plain authenticator failed for H=(spatorm) [50.202.197.108]:58607: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Dec 28 21:26:28 host2 sshd[3734868]: Disconnected from invalid user admin 202.21.38.198 port 36382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-28 21:26:56 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:55254: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-28 21:27:38 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:53984: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Dec 28 21:27:10 host2 sshd[3735307]: Disconnected from invalid user hadoop 202.21.38.198 port 43646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.117.16.125
country_id: 3865483
description:
Dec 28 21:28:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=138.117.16.125, lip=66.85.158.91, TLS, session=<06c/MwVH14yKdRB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 21:28:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LopBNAVH9oNnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.21.38.198
country_id: 1269750
description:
Dec 28 21:29:13 host2 sshd[3736770]: Disconnected from invalid user abc 202.21.38.198 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.239.60
country_id: 3469034
description:
Dec 28 21:29:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=45.65.239.60, lip=66.85.158.91, TLS, session=<J596NAVHx9EtQe88>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.121.252
country_id: 6252001
description:
Dec 28 21:30:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.168.121.252, lip=66.85.158.91, session=<HNc0OQVHKKoUqHn8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 21:30:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oPLXOQVHBcN100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 28 21:30:43 host2 sshd[3737903]: Disconnected from invalid user oracle 167.71.204.253 port 47904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 21:31:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0FTHPQVH+OEjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 28 21:32:13 host2 sshd[3738983]: Disconnected from invalid user user 167.71.204.253 port 40572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Dec 28 21:34:13 host2 sshd[3740939]: Disconnected from invalid user oracle 202.21.38.198 port 38952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 21:36:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<10BTUAVHWIanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-28 21:37:44 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:36145: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-28 21:38:21 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:61801: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec 28 21:39:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YRDmWQVHvqhBMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 28 21:39:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<tNfHWQVHUoS4aYtF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.210.15.163
country_id: 3608932
description:
Dec 28 21:44:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=181.210.15.163, lip=66.85.158.91, session=<FvswagVHHt+10g+j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-28 21:45:02 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:58756: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 28 21:45:14 host2 sshd[3749779]: Disconnected from invalid user user 156.227.233.77 port 53428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-28 21:45:19 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:41960: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 28 21:45:32 host2 sshd[3750041]: Disconnected from invalid user andres 107.175.209.254 port 45580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-28 21:45:43 dovecot_login authenticator failed for H=([128.185.243.163]) [182.95.119.118]:56084: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.71.89.9
country_id: 3469034
description:
Dec 28 21:45:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.71.89.9, lip=66.85.158.91, TLS, session=<37ogbwVHZaKxR1kJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.239
country_id: 3469034
description:
Dec 28 21:46:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=190.89.136.239, lip=66.85.158.91, TLS, session=<LkaAcAVHYN2+WYjv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 28 21:47:45 host2 sshd[3751640]: Disconnected from invalid user payara 201.186.40.250 port 38662 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 28 21:48:33 host2 sshd[3752457]: Disconnected from invalid user theta 201.186.40.250 port 52578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 28 21:49:19 host2 sshd[3753702]: Disconnected from invalid user vlad 201.186.40.250 port 38258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.203.159
country_id: 2413451
description:
2025-12-28 21:49:22 dovecot_login authenticator failed for H=([197.255.203.159]) [197.255.203.159]:44247: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 3.19.213.28
country_id: 6252001
description:
Dec 28 21:50:39 host2 sshd[3755684]: Disconnected from invalid user ansible 3.19.213.28 port 50290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 21:50:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<+Z0hggVHwrwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-28 21:51:25 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:40212: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 28 21:51:39 host2 sshd[3761918]: Disconnected from invalid user jake 156.227.233.77 port 40150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 3.19.213.28
country_id: 6252001
description:
Dec 28 21:51:46 host2 sshd[3762917]: Disconnected from invalid user vintagestory 3.19.213.28 port 32938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.113
country_id: 3996063
description:
2025-12-28 21:51:54 dovecot_login authenticator failed for H=(201.173.216.113-clientes-izzi.mx) [201.173.216.113]:44348: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Dec 28 21:51:11 host2 sshd[3758531]: Disconnected from invalid user vintagestory 34.128.77.56 port 55528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec 28 21:52:15 host2 sshd[3766901]: Disconnected from invalid user teamspeak 201.186.40.250 port 37474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 28 21:53:19 host2 sshd[3769472]: Disconnected from invalid user fs 107.175.209.254 port 49890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.209.254
country_id: 6252001
description:
Dec 28 21:54:27 host2 sshd[3770798]: Disconnected from invalid user msf 107.175.209.254 port 44430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Dec 28 21:54:29 host2 sshd[3770822]: Disconnected from invalid user cds 34.128.77.56 port 57994 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 21:55:53 host2 sshd[3772185]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 21:56:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yFRHlQVHjNQzTcpt>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[54412] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (12/10 failures) (blocked until [Mon Dec 29 16:26:05 2025 UTC/Mon Dec 29 21:56:05 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-28 21:57:25 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:46173: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-28 21:57:49 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:52766: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 28 21:58:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TXUnngVHUNhBMQFs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 21:58:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</dQhnwVHZq1A44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.116
country_id: 6252001
description:
Dec 28 21:58:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TvwSnQVH0cFBMQF0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-28 22:00:01 dovecot_login authenticator failed for H=([196.190.43.162]) [196.190.43.167]:59934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 22:00:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<OlZVowVHhogzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 21:59:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<QRRNoAVH+MGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 21:59:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<rlD8oQVHCJgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-12-28 22:00:22 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:51575: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 22:01:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<MIEVqgVHEswv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 22:02:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SS/GrAVHLt0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 22:03:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<jdIFrgVHdKov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 22:02:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<92FrqwVHONyl6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 22:05:14 host2 pure-ftpd[3780006]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 22:05:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<JsfDtwVHYMEyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.225.164
country_id: 6252001
description:
Dec 28 22:06:17 host2 sshd[3780829]: Disconnected from invalid user app 128.14.225.164 port 49690 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 22:06:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<9+9xuwVHdqVA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Dec 28 22:07:39 host2 sshd[3781789]: Disconnected from invalid user ghost 45.81.23.49 port 52068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.14.225.164
country_id: 6252001
description:
Dec 28 22:08:27 host2 sshd[3782406]: Disconnected from invalid user ubuntu 128.14.225.164 port 52332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Dec 28 22:09:23 host2 sshd[3783272]: Disconnected from invalid user sftp 168.167.228.74 port 33490 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.152
country_id: 6252001
description:
Dec 28 22:09:53 host2 pure-ftpd[3783651]: (?@64.62.156.152) [INFO] New connection from 64.62.156.152


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.225.164
country_id: 6252001
description:
Dec 28 22:10:07 host2 sshd[3783992]: Disconnected from invalid user ghost 128.14.225.164 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 22:10:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<CcOOxwVHSqpo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Dec 28 22:10:18 host2 sshd[3784219]: Disconnected from invalid user alex 45.81.23.49 port 49834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.217.162
country_id: 6252001
description:
Dec 28 22:11:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.118.217.162, lip=66.85.158.92, session=<iCrlzAVHeskUdtmi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 28 22:11:38 host2 sshd[3785222]: Disconnected from invalid user jitendra 152.200.217.230 port 33785 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.225.164
country_id: 6252001
description:
Dec 28 22:11:40 host2 sshd[3785266]: Disconnected from invalid user alex 128.14.225.164 port 41896 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.81.23.49
country_id: 2750405
description:
Dec 28 22:11:51 host2 sshd[3785521]: Received disconnect from 45.81.23.49 port 47270:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 22:13:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Id7W0wVHtscjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[51126] [Authentication Database]=[mail] [Username]=[info@anandaobauae.org] (12/10 failures) (blocked until [Mon Dec 29 16:43:34 2025 UTC/Mon Dec 29 22:13:34 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 22:14:50 host2 sshd[3787991]: Disconnected from invalid user  62.60.131.157 port 63265 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Dec 28 22:15:58 host2 sshd[3788876]: Disconnected from invalid user apache 168.167.228.74 port 33493 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 22:17:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<gVeR4AVHEoGnrKy4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.172.172.184
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.172.172.184] [Remote Port]=[33042] [Authentication Database]=[mail] [Username]=[test@venee.lk] (11/10 failures) (blocked until [Mon Dec 29 16:47:08 2025 UTC/Mon Dec 29 22:17:08 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 22:17:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<G3hb4QVHvI+i8GQy>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[49028] [Authentication Database]=[mail] [Username]=[test@dataesite.lk] (13/10 failures) (blocked until [Mon Dec 29 16:48:40 2025 UTC/Mon Dec 29 22:18:40 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 22:18:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BqYQ5gVHhL8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 22:19:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Y4Ap6AVH1ICi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 22:19:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<sDRR6QVHIIIuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 28 22:20:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<Kg556wVH2oqLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 22:20:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<prep7AVHVtmElEgp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.86.24
country_id: 2750405
description:
Dec 28 22:21:15 host2 pure-ftpd[3793140]: (?@134.209.86.24) [INFO] New connection from 134.209.86.24


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.148.194
country_id: 99237
description:
Dec 28 22:22:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=65.20.148.194, lip=66.85.158.91, session=<mB4p9QVHV81BFJTC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.75.197.174
country_id: 1269750
description:
Dec 28 22:22:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=182.75.197.174, lip=66.85.158.91, session=<viov9QVHVLK2S8Wu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.46.45.121
country_id: 290557
description:
Dec 28 22:23:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=20.46.45.121, lip=66.85.158.91, session=<WAIm9gVHp/kULi15>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.8.120.90
country_id: 3469034
description:
Dec 28 22:23:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.8.120.90, lip=66.85.158.91, session=<jWb59gVHQoG7CHha>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.194.202
country_id: 3175395
description:
Dec 28 22:23:38 host2 sshd[3794712]: Disconnected from invalid user abc1 151.57.194.202 port 4213 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.192.79.179
country_id: 3865483
description:
Dec 28 22:23:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=181.192.79.179, lip=66.85.158.91, TLS, session=<k0/b9gVHMN21wE+z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.250.149.25
country_id: 1269750
description:
Dec 28 22:23:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=117.250.149.25, lip=66.85.158.91, TLS, session=<FdBH9wVHNMV1+pUZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.92.76.210
country_id: 1694008
description:
Dec 28 22:23:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=119.92.76.210, lip=66.85.158.91, session=<A4WL9gVH6tB3XEzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 22:23:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ydi49gVH4oEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.59.202.241
country_id: 149590
description:
Dec 28 22:23:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=41.59.202.241, lip=66.85.158.91, TLS, session=<qwNw9gVH9pcpO8rx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 22:24:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<0xHx+wVHPrdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 22:25:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QJer/QVHCb1100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.163.33.187
country_id: 6252001
description:
Dec 28 22:27:30 host2 pure-ftpd[3797853]: (?@54.163.33.187) [INFO] New connection from 54.163.33.187


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 22:28:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hwAUCQZHBt4jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 28 22:28:39 host2 sshd[3798783]: Disconnected from invalid user ubuntu 36.255.66.28 port 33674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Dec 28 22:30:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.91, session=<V+uKDwZH7JVBMRRF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 28 22:30:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, session=<jVjqEQZHrr9KUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 28 22:31:23 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, session=<K1aOEwZH5klKUi8F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.194.202
country_id: 3175395
description:
Dec 28 22:32:32 host2 sshd[3803040]: Disconnected from invalid user user2 151.57.194.202 port 4727 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.128
country_id: 690791
description:
Dec 28 22:34:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=185.17.124.128, lip=66.85.158.91, TLS, session=<8umhHQZHh9m5EXyA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.66.28
country_id: 1269750
description:
Dec 28 22:34:36 host2 sshd[3805223]: Disconnected from invalid user ubuntu 36.255.66.28 port 38068 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 28 22:35:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uoT6IAZH/syi2JYl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.140
country_id: 1269750
description:
Dec 28 22:34:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.59.134.140, lip=66.85.158.91, TLS, session=<qYtTHAZHoZJnO4aM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 28 22:35:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<S/FEIwZHbOyi2JYl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 22:36:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<w7JNJwZH6NmnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.68.178.71
country_id: 3175395
description:
Dec 28 22:37:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=185.68.178.71, lip=66.85.158.91, TLS, session=<15aCKQZHsN25RLJH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.101.190
country_id: 798544
description:
Dec 28 22:38:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 9 secs): user=<info>, method=PLAIN, rip=194.150.101.190, lip=66.85.158.91, TLS, session=<3uO6LAZHTY/ClmW+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.6.140
country_id: 3202326
description:
2025-12-28 22:39:04 dovecot_plain authenticator failed for H=(T8FWR3M6R) [31.217.6.140]:21683: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 22:38:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TdUdLQZHdR1niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.139.47.252
country_id: 2300660
description:
Dec 28 22:38:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 35 secs): user=<>, rip=41.139.47.252, lip=66.85.158.91, session=<mQ0kLgZH7oQpiy/8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-28 22:38:55 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:41167: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 28 22:38:12 host2 sshd[3807944]: Disconnected from invalid user ubuntu 9.223.176.221 port 49514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.87
country_id: 1269750
description:
2025-12-28 22:38:18 dovecot_login authenticator failed for H=([122.187.230.87]) [122.187.230.87]:37788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 22:39:47 host2 sshd[3809176]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.217.6.140
country_id: 3202326
description:
2025-12-28 22:39:13 dovecot_login authenticator failed for H=(I7QG1XB55L1Y) [31.217.6.140]:21682: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.217
country_id: 6252001
description:
Dec 28 22:39:16 host2 pure-ftpd[3808849]: (?@205.210.31.217) [INFO] New connection from 205.210.31.217


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.230
country_id: 3469034
description:
Dec 28 22:39:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 87 secs): user=<info>, method=LOGIN, rip=190.89.137.230, lip=66.85.158.91, session=<LVvFKgZH5ai+WYnm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-28 22:40:51 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:49636: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-28 22:41:40 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:33793: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.37
country_id: 6252001
description:
Dec 28 22:43:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.37, lip=66.85.158.91, TLS, session=<HqJaPQZHkP2i2JYl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec 28 22:43:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DJ1xPwZHlmNBMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec 28 22:44:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS: Connection closed, session=<4vFXQQZH6JdBMQGi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.99.80.2
country_id: 1643084
description:
Dec 28 22:48:03 host2 sshd[3816175]: Disconnected from invalid user sun 118.99.80.2 port 14352 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.236.243.254
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.236.243.254] [Remote Port]=[44764] [Authentication Database]=[mail] [Username]=[test@melanifinefood.com] (12/10 failures) (blocked until [Mon Dec 29 17:17:10 2025 UTC/Mon Dec 29 22:47:10 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 22:47:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<H679SwZH3K4v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 28 22:47:56 host2 sshd[3816152]: Disconnected from invalid user niti 189.90.33.23 port 60066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.239
country_id: 1269750
description:
Dec 28 22:48:25 host2 sshd[3816499]: Disconnected from invalid user vivek 117.252.16.239 port 48426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-28 22:48:42 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:55715: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-28 22:49:03 dovecot_login authenticator failed for H=([195.222.57.190]) [195.222.57.190]:55494: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.2
country_id: 1643084
description:
Dec 28 22:50:06 host2 sshd[3818476]: Disconnected from invalid user dev 118.99.80.2 port 21896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 28 22:49:43 host2 sshd[3817965]: Disconnected from invalid user sysadmin 203.150.107.244 port 49890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 28 22:50:23 host2 sshd[3818919]: Disconnected from invalid user vncuser 203.150.107.244 port 35364 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 28 22:51:05 host2 sshd[3819424]: Disconnected from invalid user max 203.150.107.244 port 49072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 28 22:51:11 host2 sshd[3819471]: Disconnected from invalid user test_user 189.90.33.23 port 52304 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.90.33.23
country_id: 3469034
description:
Dec 28 22:52:31 host2 sshd[3820413]: Disconnected from invalid user pbsworks 189.90.33.23 port 47988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 28 22:53:07 host2 sshd[3820863]: Disconnected from invalid user username 203.150.107.244 port 33718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 22:53:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<HfYtYwZH2MszTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.239
country_id: 1269750
description:
Dec 28 22:53:56 host2 sshd[3821598]: Disconnected from invalid user yzh 117.252.16.239 port 60116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.252.16.239
country_id: 1269750
description:
Dec 28 22:55:25 host2 sshd[3823287]: Disconnected from invalid user myuser 117.252.16.239 port 48962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 22:56:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<MsgKbQZHnt+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 22:56:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HoWubQZHMK8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 22:56:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<PexMbgZHKpGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 22:57:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<6OEacQZH+IEzTcpt>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.136.122
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.136.122] [Remote Port]=[39990] [Authentication Database]=[mail] [Username]=[support@lankaherbalsolutions.com] (12/10 failures) (blocked until [Mon Dec 29 17:27:40 2025 UTC/Mon Dec 29 22:57:40 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 22:57:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xbWFcQZHNpxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-28 22:59:07 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17560: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-28 22:58:22 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:37910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2025-12-28 22:58:38 dovecot_login authenticator failed for H=72-24-210-58.cpe.sparklight.net [72.24.210.58]:50509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-28 22:58:44 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:44641: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-28 22:58:55 dovecot_login authenticator failed for H=([122.184.89.169]) [125.23.203.114]:56230: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-28 22:59:16 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:51048: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 22:59:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7TQ9eQZH4Jwv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 28 23:00:05 host2 sshd[3827659]: Disconnected from invalid user ubuntu 187.212.27.187 port 60428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 23:02:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q79YggZH+Ksv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2025-12-28 23:03:01 dovecot_login authenticator failed for H=(nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:37547: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-28 23:03:24 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:59704: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2025-12-28 23:04:39 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:61631: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.72.17.43
country_id: 2750405
description:
2025-12-28 23:04:56 dovecot_login authenticator failed for H=([77.72.17.43]) [77.72.17.43]:57492: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 23:04:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<PJxjiQZHJsIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 23:05:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<OGjkjQZHnrRA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 28 23:05:55 host2 sshd[3832303]: Disconnected from invalid user user02 187.212.27.187 port 53890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 23:07:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<4+DFlAZHzvRo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 23:07:51 host2 pure-ftpd[3833534]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 23:09:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<AZkpnAZH6pUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 23:10:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<duvAnwZHZs4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 23:10:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EvfEnwZHTISi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-28 23:14:07 dovecot_login authenticator failed for H=(I5OCqb2m8) [158.94.208.56]:60810: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec 28 23:14:23 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<t6BYrQZHGoas7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-28 23:14:31 dovecot_login authenticator failed for H=(WDnK1RN1) [158.94.208.56]:60786: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 23:14:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<LlFarwZHaKYuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Dec 28 23:14:22 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.91, session=<G7g+rQZH4BQtT7Xf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 23:15:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<+KvisgZHfgii8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-28 23:15:19 dovecot_login authenticator failed for H=(w8SZHhs44B) [158.94.208.56]:49645: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 23:15:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FePGsAZHyNcv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.94.208.56
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[158.94.208.56] [Authentication Database]=[mail] [Username]=[info] (5/5 failures) (blocked until [Sun Dec 28 18:00:41 2025 UTC/Sun Dec 28 23:30:41 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 28 23:17:45 host2 sshd[3840940]: Disconnected from invalid user dangulo 107.189.29.175 port 55690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 28 23:19:09 host2 sshd[3842127]: Disconnected from invalid user username 107.189.29.175 port 53676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 23:18:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<0iV3uwZHlMenrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 28 23:18:35 host2 sshd[3841773]: Disconnected from invalid user vpn 107.189.29.175 port 42208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 28 23:20:11 host2 sshd[3843135]: Disconnected from invalid user csgoserver 107.189.29.175 port 48372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 23:20:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<udStwwZHWaB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 23:20:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<aIOLxAZHFt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 23:22:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<wXDNygZHnLqElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 23:22:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mdNuywZH3MEFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.2
country_id: 1733045
description:
2025-12-28 23:22:54 dovecot_login authenticator failed for H=([49.124.151.2]) [49.124.151.2]:49486: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-12-28 23:22:17 dovecot_login authenticator failed for H=([120.157.27.237]) [120.157.27.237]:34016: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.179
country_id: 2658434
description:
Dec 28 23:23:44 host2 sshd[3845383]: Disconnected from invalid user oem 185.196.8.179 port 58054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-28 23:23:49 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:38416: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-28 23:23:22 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:43700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-28 23:25:39 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:42249: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-28 23:26:01 dovecot_login authenticator failed for H=([182.95.178.206]) [182.95.178.206]:46844: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.196.8.179
country_id: 2658434
description:
Dec 28 23:25:17 host2 sshd[3846917]: Received disconnect from 185.196.8.179 port 55376:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 23:25:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JppK1QZH2nUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.7.17
country_id: 3144096
description:
2025-12-28 23:28:44 dovecot_login authenticator failed for H=([84.211.7.17]) [84.211.7.17]:40692: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.178
country_id: 921929
description:
2025-12-28 23:29:02 dovecot_login authenticator failed for H=([197.255.227.178]) [197.255.227.178]:56370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 23:31:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F8LM6gZHdkdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.121.174.112
country_id: 1269750
description:
Dec 28 23:35:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.121.174.112, lip=66.85.158.91, TLS, session=<UmwK+AZHjYRnea5w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.131
country_id: 3175395
description:
Dec 28 23:35:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=217.26.179.131, lip=66.85.158.91, TLS, session=<TMoz+QZHH5fZGrOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 23:39:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<+4ZOBQdHLu2nrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 200.196.143.226
country_id: 3469034
description:
Dec 28 23:39:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=200.196.143.226, lip=66.85.158.91, TLS, session=<P4XPBgdHP8PIxI/i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.138
country_id: 1269750
description:
Dec 28 23:40:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.30.83.138, lip=66.85.158.91, TLS, session=<A3QPCAdHicdnHlOK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 23:42:39 host2 sshd[3862259]: Disconnected from invalid user username 62.60.131.157 port 29243 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 23:44:22 host2 sshd[3863720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 23:44:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PGzUGQdHdqMv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-28 23:48:19 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (sklisopink) [73.183.74.177]:39610: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 23:51:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</3QtMAdHlLUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 23:51:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<FdOeMAdHJtKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 23:53:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<8TOvOAdHXMIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 23:54:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3gThOgdHMrenrEV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-28 23:54:20 dovecot_plain authenticator failed for H=(warix) [92.62.243.174]:36089: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 23:54:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ALxJPgdHjqgzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 28 23:56:11 host2 sshd[3874972]: Disconnected from invalid user user 196.189.124.195 port 39234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 28 23:56:19 host2 sshd[3875084]: Disconnected from invalid user oem 88.147.30.59 port 40798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 23:56:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<49DCQwdHztFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 23:57:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GNydRwdHbJIv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 28 23:59:06 host2 sshd[3877725]: Disconnected from invalid user user 88.147.30.59 port 60253 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.134
country_id: 6252001
description:
2025-12-28 23:59:45 dovecot_login authenticator failed for H=([209.23.73.134]) [209.23.73.134]:44890: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-29 00:00:07 +0530] info [cpaneld] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-28 23:59:31 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:40119: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-28 23:59:42 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:43996: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 29 00:00:08 host2 sshd[3878834]: Disconnected from invalid user ftp-test 196.189.124.195 port 48546 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-29 00:00:23 +0530] info [whostmgrd] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-29 00:02:33 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:36902: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-29 00:02:44 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:45523: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Dec 29 00:03:01 host2 sshd[3881422]: Disconnected from invalid user db2inst 196.189.124.195 port 49634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-29 00:03:34 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (fienin) [76.157.219.158]:58252: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 00:03:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<mcVXXgdH0Iwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 00:03:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<oadVXgdHuOmi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 00:04:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<VY0zYAdHMpFo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 29 00:04:47 host2 sshd[3882946]: Disconnected from invalid user lekaren 88.147.30.59 port 41782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 00:04:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<OyiGXwdHwJBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 00:06:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<AUtVZwdHtqcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 00:07:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7USBbAdH6uwjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.181
country_id: 6252001
description:
Dec 29 00:09:22 host2 pure-ftpd[3886484]: (?@45.79.207.181) [INFO] New connection from 45.79.207.181


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 00:10:17 host2 sshd[3887498]: Disconnected from invalid user usuario 62.60.131.157 port 9185 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 00:10:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<SqsVdgdHXMkuZXpm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 00:10:34 host2 pure-ftpd[3887819]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.109
country_id: 6252001
description:
Dec 29 00:10:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.109, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SWVMdwdHCN7N0h9t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 29 00:11:51 host2 sshd[3888851]: Disconnected from invalid user amit 196.189.124.195 port 52328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 00:12:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<NTfYewdHFOAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 29 00:13:27 host2 sshd[3890850]: Disconnected from invalid user vivek 157.230.211.219 port 50892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 00:14:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<y1G2ggdHPKoyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 29 00:14:43 host2 sshd[3891876]: Disconnected from invalid user teamspeak 196.189.124.195 port 53812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 29 00:15:58 host2 sshd[3893664]: Disconnected from invalid user admin 88.147.30.59 port 59001 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 00:15:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<64ImiQdHFO1100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Dec 29 00:16:09 host2 sshd[3893837]: Disconnected from invalid user prod 103.25.47.94 port 44932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 00:17:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cnREjgdHaOhnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 29 00:18:29 host2 sshd[3895664]: Disconnected from invalid user shiny 34.39.58.191 port 44458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.211.219
country_id: 6252001
description:
Dec 29 00:18:46 host2 sshd[3895885]: Disconnected from invalid user backups 157.230.211.219 port 34844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 29 00:19:36 host2 sshd[3896973]: Disconnected from invalid user liz 199.195.254.215 port 55476 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.105
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.105: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 29 00:20:08 host2 sshd[3897679]: Disconnected from invalid user azureuser 34.39.58.191 port 58024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Dec 29 00:20:50 host2 sshd[3898563]: Disconnected from invalid user azureuser 103.25.47.94 port 44224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 00:20:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Nl/0mgdHULmnrKy4>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.105
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.105: 442 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 29 00:20:38 host2 sshd[3898389]: Disconnected from invalid user teamspeak 34.39.58.191 port 47558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 29 00:20:49 host2 sshd[3898553]: Disconnected from invalid user alex 160.251.172.221 port 53364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 00:22:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sXoYogdHekIjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-29 00:22:38 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:44009: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 29 00:22:50 host2 sshd[3900128]: Disconnected from invalid user david 160.251.172.221 port 41766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 00:22:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XS75oQdHtpgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-29 00:23:07 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:34831: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 29 00:22:09 host2 sshd[3899568]: Disconnected from invalid user smb 34.39.58.191 port 52772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-29 00:23:01 dovecot_login authenticator failed for H=([114.9.22.30]) [114.9.22.30]:39588: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-29 00:23:23 dovecot_login authenticator failed for H=([203.125.110.142]) [203.125.83.34]:63063: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-29 00:23:42 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:33886: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 00:24:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F0KiqQdHridniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 00:25:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<VPUZqgdHhJuElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.153
country_id: 2186224
description:
2025-12-29 00:25:18 dovecot_login authenticator failed for H=([121.73.162.153]) [121.73.162.153]:45342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-29 00:25:36 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:38231: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 00:28:01 host2 sshd[3904789]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 29 00:30:06 host2 sshd[3906688]: Disconnected from invalid user azureuser 88.147.30.59 port 37548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-29 00:38:55 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12117: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2025-12-29 00:39:09 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:49700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.218.47.149
country_id: 357994
description:
2025-12-29 00:39:09 dovecot_login authenticator failed for H=([196.218.47.149]) [196.218.47.149]:38144: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2025-12-29 00:39:53 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:49818: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 29 00:40:08 host2 sshd[3915942]: Disconnected from invalid user tom 117.216.211.19 port 36356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-29 00:40:47 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:35248: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 00:41:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KzAE5AdHBsmnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 29 00:41:54 host2 sshd[3917179]: Disconnected from invalid user weblogic 117.216.211.19 port 59638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 00:42:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<qWbl5gdHsJQv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 29 00:42:34 host2 sshd[3917592]: Disconnected from invalid user weblogic 117.216.211.19 port 43136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 29 00:43:10 host2 sshd[3917957]: Disconnected from invalid user kt 117.216.211.19 port 54860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 00:45:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<3HIx8wdHisal6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.244.233.141
country_id: 2635167
description:
Dec 29 00:46:18 host2 sshd[3921037]: Disconnected from invalid user jenkins 198.244.233.141 port 42724 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.242
country_id: 6252001
description:
Dec 29 00:46:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.19.242, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h6py9gdHFtoSYRPy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.159.83
country_id: 2921044
description:
Dec 29 00:47:26 host2 sshd[3921721]: Disconnected from invalid user user002 54.38.159.83 port 44524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 29 00:47:28 host2 sshd[3921740]: Disconnected from invalid user weblogic 170.233.151.14 port 33212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 00:47:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xzqS+wdHlJ4zTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.189
country_id: 130758
description:
Dec 29 00:49:03 host2 sshd[3923011]: Disconnected from invalid user jenkins 85.208.253.189 port 56048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 29 00:48:46 host2 sshd[3922723]: Disconnected from invalid user worker 170.233.151.14 port 56370 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 54.38.159.83
country_id: 2921044
description:
Dec 29 00:49:23 host2 sshd[3923378]: Received disconnect from 54.38.159.83 port 56034:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 29 00:49:25 host2 sshd[3923388]: Disconnected from invalid user postgres 170.233.151.14 port 51758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 00:50:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zDGfAwhHMOIv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.159.83
country_id: 2921044
description:
Dec 29 00:50:18 host2 sshd[3924196]: Disconnected from invalid user test 54.38.159.83 port 46664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 00:50:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<0PVoBQhHqounrEV8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.18
country_id: 2328926
description:
Dec 29 00:50:59 host2 pure-ftpd[3924703]: (?@102.204.223.18) [INFO] New connection from 102.204.223.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-29 00:51:42 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51762: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 00:51:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<CnLNCQhHYMUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.67
country_id: 798544
description:
Dec 29 00:52:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=91.231.121.67, lip=66.85.158.91, TLS, session=<aFWlCghHBaJb53lD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-29 00:52:28 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:39900: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.7.130
country_id: 2395170
description:
Dec 29 00:52:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng>, method=PLAIN, rip=41.74.7.130, lip=66.85.158.91, TLS, session=<Qiv3CwhHOJopSgeC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-29 00:52:50 dovecot_login authenticator failed for H=([122.187.230.13]) [122.187.230.13]:37687: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.151.70.150
country_id: 2750405
description:
2025-12-29 00:54:23 dovecot_login authenticator failed for H=31-151-70-150.dynamic.upc.nl [31.151.70.150]:37327: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 00:54:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DoJCEwhHDKdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-29 00:54:43 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:34297: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 00:54:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<hquxFAhHsoIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.146
country_id: 3469034
description:
Dec 29 00:58:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=191.240.96.146, lip=66.85.158.91, TLS, session=<w+0kHwhHRIq/8GCS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-29 00:57:14 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:62347: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 00:57:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<PCc2HQhHEoGi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-29 00:57:26 dovecot_login authenticator failed for H=([62.97.163.72]) [62.97.163.72]:35152: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.181.6
country_id: 3865483
description:
Dec 29 00:57:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.110.181.6, lip=66.85.158.91, TLS, session=<SJzoHQhHKp6+brUG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 29 00:58:24 host2 sshd[3930965]: Disconnected from invalid user git 167.71.36.180 port 64338 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 29 00:58:58 host2 pure-ftpd[3931368]: (?@66.132.153.113) [INFO] New connection from 66.132.153.113


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 29 00:59:52 host2 sshd[3932501]: Disconnected from invalid user ubuntu 167.71.36.180 port 52472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.253.95
country_id: 6252001
description:
Dec 29 00:59:47 host2 sshd[3932386]: Disconnected from invalid user ts3 199.195.253.95 port 46376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Dec 29 01:01:46 host2 sshd[3934137]: Disconnected from invalid user gis 199.195.253.95 port 53336 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 29 01:01:49 host2 sshd[3934174]: Received disconnect from 167.71.36.180 port 43178:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 01:01:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cgINKwhH0Ppo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 29 01:02:17 host2 sshd[3934507]: Disconnected from invalid user ubuntu 167.71.36.180 port 13526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 01:02:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<AT5vLwhHYqdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-29 01:03:13 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:51892: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.181.87.33
country_id: 298795
description:
Dec 29 01:03:31 host2 sshd[3935599]: Disconnected from invalid user testing 5.181.87.33 port 34024 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-29 01:03:39 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:53030: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 01:05:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Gbl1OQhHUtsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 01:05:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dJuBOghHjDcjupN+>


