# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.113
country_id: 6252001
description:
Jan  2 01:37:32 host2 pure-ftpd[3547024]: (?@20.65.193.113) [INFO] New connection from 20.65.193.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:02 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:09 dovecot_login authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 01:43:56 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1mhrO1lHqMeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.185.225
country_id: 2510769
description:
Jan  2 01:44:39 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=5.183.185.225, lip=66.85.158.91, TLS, session=<dwYHPVlHVMMFt7nh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.150.73.26
country_id: 3057568
description:
Jan  2 01:45:25 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<env_eng>, method=PLAIN, rip=193.150.73.26, lip=66.85.158.91, TLS, session=<xNlCP1lHpAnBlkka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  2 01:46:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<5xRZRVlHgP/CpRCj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 01:48:16 host2 sshd[3557714]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 01:49:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NY/8T1lHiK6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 01:49:58 host2 sshd[3559315]: Disconnected from invalid user admin 2.57.121.112 port 65424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 01:50:51 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OZ0jVFlHQOBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 01:51:38 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qinxVllHqMMv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  2 01:57:27 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, session=<6n7ca1lHgva5qQRo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 01:58:18 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4ELDbllHJpIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 02:01:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<PtsleVlHYMKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Jan  2 02:03:35 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, session=<l6XNgVlHRv/N0h9s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 02:07:45 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tv6VkFlHhpMvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.213.26.23
country_id: 6252001
description:
Jan  2 02:09:19 host2 sshd[3579397]: Disconnected from invalid user jack 209.213.26.23 port 58646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Jan  2 02:10:46 host2 sshd[3580919]: Disconnected from invalid user user01 154.92.109.196 port 6916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Jan  2 02:11:23 host2 sshd[3581462]: Disconnected from invalid user ubuntu 154.92.109.196 port 44637 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 02:14:25 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RU1xqFlHnscjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.213.26.23
country_id: 6252001
description:
Jan  2 02:15:57 host2 sshd[3586056]: Disconnected from invalid user mob 209.213.26.23 port 49980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:16:46 host2 sshd[3587096]: Disconnected from invalid user ansible 162.214.126.1 port 56584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 02:16:51 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eSEUsVlHOoKi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.40
country_id: 6252001
description:
Jan  2 02:16:08 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.40, lip=66.85.158.91, TLS, session=<WGemrllHmPfG6xgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:17:24 host2 sshd[3587669]: Disconnected from invalid user sistemas 162.214.126.1 port 40630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2026-01-02 02:17:47 dovecot_plain authenticator failed for H=(appos) [195.133.156.119]:40834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:17:55 host2 sshd[3588221]: Disconnected from invalid user red5 162.214.126.1 port 52228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:18:25 host2 sshd[3588698]: Disconnected from invalid user celia 162.214.126.1 port 35606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 02:20:00 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LLVivFlHiJieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 02:21:15 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<5GzTwFlHEL+eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 02:22:46 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+jZKxllHBDNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 02:22:16 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<zXx/xFlHTJMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 02:22:22 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7wTOxFlHroJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-02 02:23:43 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60079: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 02:24:40 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<1nQXzVlH+FRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 02:25:29 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<xZv/z1lHIJoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan  2 02:25:58 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VSzV0VlHmnO4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan  2 02:26:17 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Aa7+0llH8mu4aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 02:29:43 host2 pure-ftpd[3599994]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.4
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.4: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 02:37:19 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1cpI+llHosJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.229
country_id: 6252001
description:
Jan  2 02:38:32 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.229, lip=66.85.158.92, session=<BlbC/llHNRNAPsXl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Jan  2 02:38:44 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS: Connection closed, session=<AgJ+/1lHxMRAPsXj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:44:18 host2 sshd[3614350]: Disconnected from invalid user ana 165.154.1.18 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  2 02:44:22 host2 sshd[3614423]: Disconnected from invalid user admin1 186.80.18.158 port 34230 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  2 02:45:28 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<yxKcF1pHOv7CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 02:45:54 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<tSsBGVpHoKueRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:47:14 host2 sshd[3618287]: Disconnected from invalid user bounce 178.62.43.176 port 43348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:47:47 host2 sshd[3618835]: Disconnected from invalid user francois 178.62.43.176 port 33322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:48:18 host2 sshd[3619565]: Disconnected from invalid user vagrant 178.62.43.176 port 41146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 02:48:47 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Y2NKI1pHyJpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:49:13 host2 sshd[3620399]: Disconnected from invalid user fiscal 165.154.1.18 port 41548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 02:49:50 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pQwYJ1pHEtyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:50:42 host2 sshd[3622290]: Disconnected from invalid user elias 165.154.1.18 port 59620 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  2 02:51:25 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qyvjLFpH9NdBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 02:57:11 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jQNZQVpHnNwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 03:00:22 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<N025TFpHzEcjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 03:01:34 host2 sshd[3634562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 03:01:14 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<0rnST1pHYMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.115.146
country_id: 3865483
description:
Jan  2 03:01:17 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.110.115.146, lip=66.85.158.91, TLS, session=<6C3+TlpHr8O+bnOS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.50
country_id: 3175395
description:
Jan  2 03:01:35 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.106.50, lip=66.85.158.91, TLS, session=<5Lo8UFpHatK50Goy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Jan  2 03:02:17 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.95, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ds+9U1pH4cnG6xhf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 03:07:53 host2 sshd[3641221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.195.210.47
country_id: 6252001
description:
Jan  2 03:08:11 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=194.195.210.47, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6tvQaFpHLd3Cw9Iv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:12:28 host2 sshd[3645792]: Disconnected from invalid user sysadmin 164.92.140.160 port 44910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 03:12:14 host2 sshd[3645612]: Invalid user sivagnanamfoundation from 93.123.109.114 port 43318


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:13:12 host2 sshd[3646446]: Disconnected from invalid user cctv 160.202.8.218 port 43412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 03:13:16 host2 sshd[3646515]: Disconnected from invalid user user 2.57.121.25 port 38062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:13:49 host2 sshd[3647058]: Disconnected from invalid user trial 160.202.8.218 port 51168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:14:25 host2 sshd[3647605]: Disconnected from invalid user cmm 160.202.8.218 port 58924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Jan  2 03:15:26 host2 sshd[3648855]: Disconnected from invalid user deployhq 9.223.176.221 port 36248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:15:35 host2 sshd[3649103]: Disconnected from invalid user remoto 160.202.8.218 port 46202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:15:41 host2 sshd[3649226]: Disconnected from invalid user testing 164.92.140.160 port 57006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 03:16:35 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5N22hlpHmEQjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  2 03:17:06 host2 sshd[3650820]: Disconnected from invalid user steam 216.155.93.75 port 49825 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-02 03:16:40 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:53926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:16:48 host2 sshd[3650463]: Disconnected from invalid user frappe 164.92.140.160 port 45082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:16:57 host2 sshd[3650630]: Disconnected from invalid user max 40.82.214.8 port 57596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:16:15 host2 sshd[3649828]: Disconnected from invalid user web 164.92.140.160 port 56734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:16:25 host2 sshd[3650011]: Disconnected from invalid user admin 103.193.176.131 port 45940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:17:40 host2 sshd[3651442]: Disconnected from invalid user lee 103.193.176.131 port 46046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:17:14 host2 sshd[3650980]: Disconnected from invalid user dell 5.182.83.231 port 47858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 03:17:15 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<PXsdiVpHKxRniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-02 03:17:29 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:59606: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Jan  2 03:17:29 host2 sshd[3651252]: Disconnected from invalid user riccardo 196.188.120.232 port 54160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 03:18:16 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<jn+/jFpHOnyi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:18:54 host2 sshd[3652838]: Disconnected from invalid user ftpupload 164.92.140.160 port 33944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:18:22 host2 sshd[3652310]: Disconnected from invalid user mina 40.82.214.8 port 50640 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Jan  2 03:18:27 host2 sshd[3652375]: Disconnected from invalid user xq 138.124.158.147 port 60812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:19:52 host2 sshd[3653738]: Disconnected from invalid user test 103.217.145.104 port 47304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 03:19:57 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<g+/GklpHVt6eRdY+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[56918] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (12/10 failures) (blocked until [Fri Jan  2 21:49:55 2026 UTC/Sat Jan  3 03:19:55 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 03:19:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3TEWkFpH2MQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:19:30 host2 sshd[3653381]: Disconnected from invalid user trial 103.193.176.131 port 46204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:19:50 host2 sshd[3653723]: Disconnected from invalid user ubuntu 40.82.214.8 port 49560 [preauth]


