# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 02:18:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<8lfLIPVGrF6nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:18:33 host2 sshd[2752841]: Disconnected from invalid user vpnuser1 103.52.115.25 port 41618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 02:18:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3EdKI/VG1Mgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 02:19:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<MxDLI/VGRrYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:19:12 host2 sshd[2755028]: Disconnected from invalid user steve 103.52.115.25 port 48140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:19:50 host2 sshd[2757028]: Disconnected from invalid user test2 103.52.115.25 port 45716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 02:21:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<RZKcLPVGcrEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 02:22:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<B/ncLvVGcJwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 02:22:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<xNBfL/VGIosuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.64.39.41
country_id: 953987
description:
Dec 28 02:29:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=102.64.39.41, lip=66.85.158.91, TLS, session=<As4OR/VGD7BmQCcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.135
country_id: 3469034
description:
Dec 28 02:29:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=177.44.96.135, lip=66.85.158.91, TLS, session=<FQ5jSPVGCJyxLGCH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 02:30:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<dIAVTfVGArYv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 02:33:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JxMDWPVGXrQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 02:35:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<UQ5HX/VGpNUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2025-12-28 02:36:02 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:44404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 02:37:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Q4wZZPVGSK8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 02:36:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pqn8YPVGuqAv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.227
country_id: 357994
description:
2025-12-28 02:36:22 dovecot_login authenticator failed for H=([195.43.5.227]) [195.43.5.227]:58415: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 02:36:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<GaZqYvVGBIii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-28 02:36:43 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:34734: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 02:38:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Yu27Z/VGHLto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 02:38:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<IWyiafVGPouElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-28 02:39:21 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (brept) [71.224.169.28]:60564: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.177
country_id: 6252001
description:
Dec 28 02:40:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<li7XcPVG8dDN0h+x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 02:45:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<rN6GgPVGhv+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 02:45:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5Tx5gvVGHjsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 02:46:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tCqdhfVG+rynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 02:48:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TD7ji/VGrMVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 02:48:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<tVdJjvVGgJWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 02:50:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<vCGPlPVG9sOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-28 02:51:55 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:52063: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-28 02:51:40 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:52602: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 02:53:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WlYxnfVGnucv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 02:55:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<goKnp/VGjMGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 02:56:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<XL+2qvVGLKEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 02:58:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Rxwdr/VGlqvBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 02:58:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<r+5rr/VGWzNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 02:59:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<nJCgs/VGQG4jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.246.4
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.28.246.4 - kamechot "GET /json-api/cpanel?api.version=1&cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 03:00:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<bQLuuPVG1pZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 03:01:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xTNfu/VGU1V100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 03:01:50 host2 sshd[2804456]: Disconnected from invalid user  62.60.131.157 port 20198 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:02:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bFNTwPVG9OOnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 03:04:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<tFeBxPVGrqwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 03:04:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<lyFfxfVGFJBV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 03:06:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<G6/HzfVGesTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-28 03:07:03 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:48062: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 03:09:07 host2 sshd[2808450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 03:08:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=</LE11vVG8s9hSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 03:09:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<kQeP1vVGJjenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-12-28 03:09:54 dovecot_plain authenticator failed for H=dsl540122f2.fixip.t-online.hu (hestin) [84.1.34.242]:46100: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-28 03:11:09 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:59674: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-28 03:11:37 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:33787: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 03:11:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<+0rZ4PVGsLIv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.68.150
country_id: 1835841
description:
Dec 28 03:13:34 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=118.193.68.150, lip=66.85.158.91, session=<GCje5vVGLNR2wUSW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.68.150
country_id: 1835841
description:
Dec 28 03:14:12 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=118.193.68.150, lip=66.85.158.92, session=<Rgkc6fVG0qt2wUSW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:14:51 dovecot_login authenticator failed for H=(3fDj0Z39) [160.25.73.147]:56348: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:15:15 dovecot_login authenticator failed for H=(xYrA9SPP) [160.25.73.147]:65345: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[51148] [Authentication Database]=[mail] [Username]=[admin@rehanseo.online] (10/10 failures) (blocked until [Sun Dec 28 21:46:17 2025 UTC/Mon Dec 29 03:16:17 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 03:16:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EEaX8PVGzMcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:16:27 dovecot_login authenticator failed for H=(4i5VEWR4wK) [160.25.73.147]:63014: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 160.25.73.147
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[160.25.73.147] [Authentication Database]=[mail] [Username]=[info@lezzarotech.com] (5/5 failures) (blocked until [Sat Dec 27 22:01:25 2025 UTC/Sun Dec 28 03:31:25 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.177
country_id: 1269750
description:
Dec 28 03:18:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.84.202.177, lip=66.85.158.91, TLS, session=<gx/19vVGuoxnVMqx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.6
country_id: 1269750
description:
Dec 28 03:18:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.246.170.6, lip=66.85.158.91, TLS, session=<R8E6+PVGh8Jn9qoG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 28 03:21:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<mMLRAfZGIf/CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 03:23:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<3R2gCPZGMqMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 03:23:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sZh/CvZGIp8v7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 03:25:33 host2 sshd[2824898]: Disconnected from invalid user armani 62.60.131.157 port 5953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 03:26:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<xjOwFPZG6K6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 03:26:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<RyLoFPZGsIszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 03:27:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gRTjFvZGRogv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:28:55 host2 sshd[2827726]: Disconnected from invalid user esuser 209.141.43.77 port 43936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:30:12 host2 sshd[2828508]: Disconnected from invalid user cindy 54.38.52.18 port 49190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 03:29:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<uVTIHvZGcqsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 03:29:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<zGuyIPZGGPNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 03:31:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<xYt/JfZGRtqElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:31:25 host2 sshd[2829214]: Disconnected from invalid user proxyuser 209.141.43.77 port 51020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.94.163.47
country_id: 6252001
description:
Dec 28 03:31:59 host2 pure-ftpd[2829537]: (?@155.94.163.47) [INFO] New connection from 155.94.163.47


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:32:53 host2 sshd[2830429]: Disconnected from invalid user zhangsong 209.141.43.77 port 46680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:33:35 host2 sshd[2831202]: Disconnected from invalid user git 209.141.43.77 port 58626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-12-28 03:33:48 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:55653: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-28 03:34:06 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:46830: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 28 03:33:28 host2 sshd[2831051]: Disconnected from invalid user oracle 103.82.240.194 port 38228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 28 03:35:51 host2 sshd[2833073]: Disconnected from invalid user xyh 103.82.240.194 port 33200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:36:01 host2 sshd[2833235]: Disconnected from invalid user alba 54.38.52.18 port 33740 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 03:36:36 host2 sshd[2833650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 28 03:36:28 host2 sshd[2833555]: Disconnected from invalid user minecraft 152.32.172.161 port 46068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:37:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<DMKcPPZGKr6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 03:37:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dhRePfZGmD0jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 28 03:38:16 host2 sshd[2834887]: Disconnected from invalid user oracle 152.32.172.161 port 40966 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:38:30 host2 sshd[2835041]: Received disconnect from 54.38.52.18 port 39608:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 03:38:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qff5P/ZG1E+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 28 03:41:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.91, TLS: Connection closed, session=</QugSfZGRKuVHDF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 03:40:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<peC5SPZGcI9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-28 03:41:48 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:32996: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-28 03:42:10 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:33753: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 03:41:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<j8TdSvZGjNSl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:42:34 host2 sshd[2837867]: Disconnected from invalid user cassandra 181.46.131.55 port 57636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 03:43:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<KO9wUPZGqMOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 03:44:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<9kRfVPZGNNsv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:44:33 host2 sshd[2839415]: Disconnected from invalid user share 205.185.125.150 port 38316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:45:15 host2 sshd[2840636]: Disconnected from invalid user oracle 205.185.125.150 port 50110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:45:53 host2 sshd[2841453]: Disconnected from invalid user ymoreno 205.185.125.150 port 33668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 28 03:46:07 host2 sshd[2841835]: Disconnected from invalid user ymoreno 103.88.76.27 port 35648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 28 03:48:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<p6QGYvZGNP7CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 03:48:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tR9ZZPZGyr0v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 28 03:50:23 host2 sshd[2845559]: Disconnected from invalid user oracle 103.88.76.27 port 44558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 03:50:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<WuRVa/ZGspSnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 03:50:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<uj9sbPZGfNzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 03:51:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6fhhbvZGVo8jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2025-12-28 03:52:17 dovecot_login authenticator failed for H=([122.187.223.78]) [182.66.214.34]:47174: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 03:52:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<3dZUcfZGdRRniu0S>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 28 03:52:40 host2 sshd[2847482]: Received disconnect from 195.25.17.31 port 12944:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 03:52:44 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:55936: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:53:23 host2 sshd[2848029]: Disconnected from invalid user diego 181.46.131.55 port 43210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:54:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rbudePZGvqynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 03:55:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2/AMe/ZGTOJ100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2025-12-28 03:55:53 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:40064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-28 03:56:09 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:44264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.226.238.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.226.238.137 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.50.216.87
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.50.216.87 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.128.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.128.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.35.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.35.122 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 28 03:56:14 host2 sshd[2850788]: Disconnected from invalid user user 195.25.17.31 port 29329 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 03:56:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<MWQrgPZG5Isv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.127.104.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.127.104.107 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.174.2.163
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 146.174.2.163 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.212.171.147
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.212.171.147 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.219.194.87
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.219.194.87 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.35.200.45
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.35.200.45 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.117.79.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 152.117.79.21 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.183.205.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.183.205.135 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.26.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.179.26.107 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.16.53
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.61.16.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.221.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.221.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.140
country_id: 1269750
description:
Dec 28 03:57:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.140, lip=66.85.158.91, TLS, session=<J9u5g/ZGK9hnpPaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.229
country_id: 3469034
description:
Dec 28 03:58:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.72.229, lip=66.85.158.91, TLS, session=<8vj0hPZGHbW7eEjl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:59:22 host2 sshd[2853311]: Disconnected from invalid user user 181.46.131.55 port 59696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 03:59:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<af88jPZGFqhV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-28 03:59:54 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:37317: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 04:00:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NLrLj/ZGvoJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 04:02:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Cf0XlPZGdMAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 04:01:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MXCHkfZGWlmnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 04:01:39 host2 sshd[2855184]: Disconnected from invalid user sens 181.46.131.55 port 50034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 04:03:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<CFoZmPZGirnD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.68.231
country_id: 2921044
description:
Dec 28 04:03:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.68.231, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UTAbm/ZGv+JEt0Tn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:04:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<AM7NnPZGPJ0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 04:04:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kEv8nPZGqOEyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 04:04:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.71.87, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0OU0nfZGdqGl6EdX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 04:05:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=</b3JofZGbtbJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 04:06:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</7yypPZGrrkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 04:08:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<Mw5Zq/ZGgsVhSlS6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.127.133
country_id: 6252001
description:
Dec 28 04:10:28 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.127.133, lip=66.85.158.92, session=<FrBUsvZGRlOs7H+F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:11:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jFB4tPZGGOIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 04:13:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<Z2sPvvZGXKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 04:14:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<oJXJwPZG6MWi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.142.115
country_id: 1655842
description:
Dec 28 04:14:39 host2 sshd[2867715]: Disconnected from invalid user vyos 202.137.142.115 port 34496 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 04:15:03 host2 pure-ftpd[2868341]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 04:16:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Y0xjxvZG1NAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 04:15:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<dC4AxPZGgoOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 04:15:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9dx5xfZGWuii8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2025-12-28 04:16:00 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:37110: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 04:17:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55381: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 04:17:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0Hrly/ZGEMsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:17:53 host2 sshd[2871166]: Disconnected from invalid user ftpuser 85.185.120.213 port 39840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 04:18:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<rXKu0PZGMIykXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:19:08 host2 sshd[2872695]: Disconnected from invalid user bot 223.123.65.45 port 43378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 04:18:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dj/mzvZGCIFnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:20:11 host2 sshd[2874190]: Disconnected from invalid user admin 85.185.120.213 port 59182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:21:30 host2 sshd[2875760]: Disconnected from invalid user smbuser 223.123.65.45 port 36804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:21:38 host2 sshd[2875905]: Disconnected from invalid user debian 24.144.124.91 port 41206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 04:23:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<fC453/ZGpOWnrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:23:12 host2 sshd[2877815]: Disconnected from invalid user dylan 223.123.65.45 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 04:22:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<75RD3PZGnSVniu0S>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:22:53 host2 sshd[2877370]: Received disconnect from 85.185.120.213 port 41348:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:22:53 host2 sshd[2877370]: Disconnected from invalid user master 85.185.120.213 port 41348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:23:23 host2 sshd[2878059]: Disconnected from invalid user steam 24.144.124.91 port 53824 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 04:23:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Kw/b4PZGYL2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.233
country_id: 1269750
description:
Dec 28 04:23:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.164.246.233, lip=66.85.158.91, TLS, session=<sO9h4fZGzbZnpPbp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.212
country_id: 99237
description:
Dec 28 04:24:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=65.20.143.212, lip=66.85.158.91, TLS, session=<m6uR4vZGv9JBFI/U>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:24:30 host2 sshd[2879371]: Disconnected from invalid user mohit 85.185.120.213 port 39720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 04:24:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<T+7e5fZGrLnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 04:25:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<pl6E6fZG4rNV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 04:26:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<7roX6/ZG9u5100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:26:30 host2 sshd[2881737]: Disconnected from invalid user odoo 24.144.124.91 port 45608 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:27:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<z3qf7vZGHKIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 04:28:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<uZp78vZGaJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 04:30:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vr67+vZGRMkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 04:34:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4OGvCfdG1uQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-28 04:38:53 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:53734: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 04:39:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HcvXGPdGkrqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 04:39:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<IYIGG/dG/JQFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-28 04:39:50 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:52523: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:40:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<L9EjHfdGlJ4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-28 04:40:31 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:56879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-28 04:40:58 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:59589: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:41:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8FNzH/dGSLIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 04:42:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<UNRXJvdGuIenYwhf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.195.254
country_id: 6252001
description:
Dec 28 04:43:53 host2 pure-ftpd[2899780]: (?@20.127.195.254) [INFO] New connection from 20.127.195.254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 04:47:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=</n1TN/dG9osyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 04:48:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<xUYWO/dGpIAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:51:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<9DBvRfdGeowv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 04:52:16 host2 sshd[2909981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 28 04:53:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<P5/2TfdGkf8t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-28 04:54:11 dovecot_login authenticator failed for H=([84.213.191.100]) [84.213.191.100]:46452: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-28 04:53:46 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:50867: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 28 04:56:22 host2 sshd[2914748]: Disconnected from invalid user joel 118.193.39.127 port 36742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 04:57:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<vFpIWfdGGMovWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 28 04:57:33 host2 sshd[2915829]: Disconnected from invalid user openwrt 118.193.39.127 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 28 04:58:46 host2 sshd[2916988]: Disconnected from invalid user server1 164.92.106.89 port 41892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 04:59:03 host2 sshd[2917241]: Disconnected from invalid user  62.60.131.157 port 17243 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 28 04:59:20 host2 sshd[2917488]: Disconnected from invalid user mapadmin 164.92.106.89 port 54152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-28 04:59:28 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:58366: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:00:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QcO0Y/dGBMgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 05:00:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Ygl2ZfdG1Kpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:00:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<tdGrZvdGhI4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 05:02:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<6t0EbPdGXtyElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:03:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<je1kb/dGUM8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 05:03:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<gvqMb/dG/q+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-28 05:05:16 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:57034: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2025-12-28 05:05:44 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:60775: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:06:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<AaKwevdG9rwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 05:06:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<83RDfPdGFIel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.179
country_id: 3175395
description:
Dec 28 05:07:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.171.179, lip=66.85.158.91, TLS, session=<gNavfPdGfci5D6uz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 05:07:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gvjHffdG0hKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.252
country_id: 1269750
description:
Dec 28 05:07:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.55.105.252, lip=66.85.158.91, TLS, session=</YLVffdGcLNnN2n8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:07:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pzW7f/dGWjMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 05:08:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<0BVVgfdGgIBhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 05:08:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<4nyTgfdGTMlA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 28 05:08:32 host2 sshd[2925322]: Disconnected from invalid user lighthouse 162.240.39.179 port 35492 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 05:08:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<mBN8gvdGZqjBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 05:09:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VOVEhfdGZL1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 05:10:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<b6ZUh/dGdJakXF7M>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 28 05:09:39 host2 sshd[2925908]: Received disconnect from 162.240.39.179 port 59270:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 05:10:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<pXBAh/dGBtMvT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 05:11:00 host2 sshd[2927241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.103.6.1
country_id: 690791
description:
Dec 28 05:10:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.103.6.1, lip=66.85.158.91, TLS, session=<G7abifdG9dmwZwYB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.121.185
country_id: 6290252
description:
Dec 28 05:11:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.121.185, lip=66.85.158.91, TLS, session=<4q2yivdGZqFtznm5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 05:11:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<xf0WjvdGVsmnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.7
country_id: 2328926
description:
Dec 28 05:13:45 host2 pure-ftpd[2929184]: (?@102.204.223.7) [INFO] New connection from 102.204.223.7


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 05:14:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<uzFumPdGZTVniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-28 05:15:35 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:56352: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 05:15:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<d2rrm/dG9JenrEV8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 05:15:53 host2 pure-ftpd[2931208]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2025-12-28 05:16:05 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:46630: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.57.131
country_id: 6252001
description:
Dec 28 05:17:06 host2 pure-ftpd[2932025]: (?@20.106.57.131) [INFO] New connection from 20.106.57.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:17:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SY00ofdGxrIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 05:18:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PPHBpPdGI9p100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:18:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MCvIpfdG8tQv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 28 05:19:34 host2 sshd[2934001]: Disconnected from invalid user monica 160.251.197.41 port 38192 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 05:19:48 host2 sshd[2934209]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Dec 28 05:19:35 host2 sshd[2934030]: Disconnected from invalid user deployer 40.117.97.0 port 38436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 05:19:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<AWD8qfdGSttV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:21:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OEuHr/dGaKEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 05:21:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<vucusPdGeuTD+hnW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.152.158
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.152.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.198.3.123
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.198.3.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.154.184.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.154.184.103 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.80.143.197
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.80.143.197 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.172.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.112.172.162 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.78.197
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.78.197 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-28 05:23:16 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:48753: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.97.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.17.97.181 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.205.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.113.205.178 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.107.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.107.244 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.76.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.158.76.237 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.189.16.18
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.189.16.18 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.9.59
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.9.59 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.86.192
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.164.86.192 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.129.23
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.189.129.23 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 28 05:24:07 host2 sshd[2937595]: Disconnected from invalid user db2fenc2 160.251.197.41 port 45174 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.95
country_id: 2921044
description:
Dec 28 05:23:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.101.122.95, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ARjdt/dGNsguZXpf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-28 05:23:39 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:54891: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-28 05:25:33 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:53630: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 05:24:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<N0Ftu/dGBscv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 28 05:24:52 host2 sshd[2937959]: Disconnected from invalid user oracle 4.210.186.201 port 40161 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 05:27:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Alo6x/dG6JWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.16
country_id: 2186224
description:
2025-12-28 05:29:30 dovecot_login authenticator failed for H=([121.73.169.16]) [121.73.169.16]:38154: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-28 05:29:42 dovecot_login authenticator failed for H=(dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:48928: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 05:31:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3B7X0/dGLJwFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 05:31:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<iu9a1PdG7o8v7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.81.106
country_id: 2921044
description:
Dec 28 05:32:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.122.81.106, lip=66.85.158.91, session=<Jdfv1fdGhf6GelFq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 05:32:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.71.87, lip=66.85.158.91, session=<3Qb81fdGQvOl6EdX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-28 05:32:12 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:32860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 05:33:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<fe7w2vdGSrOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-28 05:32:35 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:57778: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:33:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<SMmk2fdGwJYv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.42
country_id: 6252001
description:
Dec 28 05:35:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+8oB4fdGqIoUqwgq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 05:38:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<JWAE7fdGMqwuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.150.192.39
country_id: 6252001
description:
Dec 28 05:37:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.150.192.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UdTk6vdGerMUlsAn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 05:37:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<K9I+6/dGdqEyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-28 05:38:53 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:57974: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-28 05:39:05 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:48274: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 05:43:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<K/Br/fdG6uwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 05:47:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<WP5mC/hGFp0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:47:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<FS9CDvhGVOczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-28 05:48:26 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:55476: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2025-12-28 05:49:32 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:32844: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2025-12-28 05:48:46 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:50528: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-28 05:49:53 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:59481: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:50:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<wYEOF/hGOogv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:51:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<M3slGvhGFLgzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec 28 05:51:29 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.92, session=<PAWhG/hGusWsaYAL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 05:52:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<f1LFHvhG8J5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 05:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<IKEbIfhGKL2ElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 05:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<sdQaIfhGppWi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-28 05:57:58 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (anirlamity) [89.25.223.210]:56416: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 05:58:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<585TNvhGEJul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:58:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<49lJNvhGiC8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 05:59:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<D6w2OPhGDoWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:00:07 host2 sshd[2963909]: Disconnected from invalid user ryan 202.51.214.99 port 50594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 06:01:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CleNPvhGgMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:01:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<uVnAPvhGYJenrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:02:06 host2 sshd[2965409]: Disconnected from invalid user webuser 202.51.214.99 port 48494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:01:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3f1iP/hGVLYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 06:01:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Nn6uP/hG/KCkXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:02:46 host2 sshd[2965818]: Disconnected from invalid user toro 202.51.214.99 port 60132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 06:04:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Ea+dSfhGLLrBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-28 06:04:58 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:36146: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-28 06:05:20 dovecot_login authenticator failed for H=([122.187.193.1]) [182.95.178.154]:34074: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2025-12-28 06:05:55 dovecot_login authenticator failed for H=([177.174.89.105]) [177.174.89.99]:54397: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:06:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZktHUvhGqLIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.240.104
country_id: 3469034
description:
Dec 28 06:07:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.92.240.104, lip=66.85.158.91, TLS, session=<80tVUvhGgbixXPBo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-28 06:07:36 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:41883: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 06:07:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gCJuVvhG+xFniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-28 06:08:01 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:58498: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.112
country_id: 3057568
description:
Dec 28 06:07:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=91.226.115.112, lip=66.85.158.91, TLS, session=<FeErVPhGgMpb4nNw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-28 06:08:27 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:55849: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:08:37 host2 sshd[2969885]: Disconnected from invalid user  62.60.131.157 port 7743 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:10:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3De6XfhGbNAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-28 06:10:03 dovecot_login authenticator failed for H=([128.185.231.114]) [128.185.231.114]:44060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-12-28 06:10:18 dovecot_login authenticator failed for H=104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:60405: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 06:09:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Yli3W/hGlpOnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.141.76
country_id: 690791
description:
Dec 28 06:11:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.141.76, lip=66.85.158.91, TLS, session=<DBGQYPhGYMcl3Y1M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 06:10:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<iM4WYPhGXM1100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 83.143.30.71
country_id: 933860
description:
Dec 28 06:10:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=83.143.30.71, lip=66.85.158.91, TLS, session=<mQVNX/hGF91Tjx5H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 06:12:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<17UnZvhGCHwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 06:14:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<fHgHbPhG1MRV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-28 06:14:50 dovecot_login authenticator failed for H=([182.95.52.206]) [182.95.52.206]:39626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 06:15:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<SxXVb/hG5qgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-28 06:15:14 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:52350: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:17:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<FXnMePhGjpmnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 06:18:21 host2 pure-ftpd[2977409]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 06:18:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<SeiKffhGYLbD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 06:23:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<QM6+jfhGAoQv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-28 06:23:30 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:59570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 06:23:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<gcuVjvhGPmynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.141
country_id: 2413451
description:
2025-12-28 06:23:41 dovecot_login authenticator failed for H=([197.255.200.141]) [197.255.200.141]:36479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 06:24:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<YLatkPhG/MsFhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - essencec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:25:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<cQ1tlPhGStEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 06:28:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Zw8yoPhG5oQuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 06:29:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Drg5o/hGAL0yBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.242
country_id: 6252001
description:
Dec 28 06:29:58 host2 pure-ftpd[2985545]: (?@38.148.242.242) [INFO] New connection from 38.148.242.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:31:36 host2 sshd[2986993]: Disconnected from invalid user  62.60.131.157 port 33581 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 06:34:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<OnUOt/hGIuMv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.243.253.241
country_id: 3577718
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 104.243.253.241 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 06:36:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<iL1Bu/hGwMAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 06:37:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ldFywPhG6tsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 06:39:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</NhAx/hGKtQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-28 06:39:38 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:53665: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:39:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vCTKyPhGLM4v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-28 06:40:10 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:39262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.119.65.249
country_id: 690791
description:
Dec 28 06:43:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.119.65.249, lip=66.85.158.91, TLS, session=<VVw+1PhGCaOwd0H5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 06:43:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<AHDA1PhGrNyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 06:43:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<b9qE1fhGRKVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.131
country_id: 2510769
description:
Dec 28 06:43:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.145.43.131, lip=66.85.158.91, TLS, session=<8XFS1fhGYLO5kSuD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 06:44:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<kQL12PhG7J2ElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 06:50:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XLfU7fhGGncjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 06:51:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ZDgE8fhGWsKl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.112
country_id: 6252001
description:
Dec 28 06:50:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.112, lip=66.85.158.91, TLS, session=<mQJt8PhGIP/G6xhw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 06:52:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gwUk9PhGvDKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:51:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Ws3L8vhGpp6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 06:53:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6kds+PhGXNmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 06:54:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<BS6n+/hGHtVnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:54:41 host2 sshd[3005135]: Disconnected from invalid user  62.60.131.157 port 39049 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<yHgUBPlGcMYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:56:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1x+FBPlGWNgv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.246
country_id: 6252001
description:
Dec 28 07:00:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.246, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9KopEvlGV9fN0h/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 07:00:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<3bMNFPlG5NXBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 07:01:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7gDDFPlGxz5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:02:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<noYIGPlG9L0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 07:02:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3FRdGvlGlM6nrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.114.107
country_id: 2921044
description:
Dec 28 07:02:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=157.230.114.107, lip=66.85.158.91, session=<yc9UG/lGK+ed5nJr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.128.120
country_id: 2921044
description:
Dec 28 07:03:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.128.120, lip=66.85.158.91, session=<AUpiG/lGwNWkXIB4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 07:03:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<L01FHPlGnUR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 07:03:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GHS5HflG+sQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 07:05:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VuD1JflGDoov+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 07:07:49 host2 sshd[3015274]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 07:07:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<zrACLPlGwrhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 07:08:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<GZsULvlGqJinrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 07:08:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0Q7GL/lGKp5V6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.229
country_id: 3175395
description:
Dec 28 07:10:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.170.229, lip=66.85.158.91, TLS, session=<F1y0NflGjtK5D6rl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.61.2
country_id: 2215636
description:
Dec 28 07:10:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=165.16.61.2, lip=66.85.158.91, TLS, session=<TQnWNvlGRKylED0C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 28 07:12:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4ki0PvlGEDlChJmA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 07:12:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WxX7PvlGDFKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 07:15:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7FlRSPlGJOUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 07:16:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9d8DTPlGcI3D+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 07:17:36 host2 sshd[3022726]: Disconnected from invalid user  62.60.131.157 port 15799 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 07:17:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<le00UPlGBI4FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:17:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Al9QUPlGdt8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2025-12-28 07:18:35 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:46663: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 07:19:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Gt6YVPlGCsEuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-28 07:19:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:34076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 07:20:59 host2 pure-ftpd[3025572]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 07:21:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<vjtoXflGarAyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-28 07:21:42 dovecot_plain authenticator failed for H=(applar) [75.97.190.237]:59830: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 07:25:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<4mStavlGEIAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-28 07:26:17 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:35142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.102
country_id: 3996063
description:
2025-12-28 07:26:59 dovecot_login authenticator failed for H=(187.161.222.102-clientes-izzi.mx) [187.161.222.102]:46404: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 07:27:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O5uScflGmNMv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-28 07:26:34 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:34373: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 07:28:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<TnbxdvlGbqgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 07:28:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Xjikd/lG+KwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.204
country_id: 2413451
description:
2025-12-28 07:29:28 dovecot_login authenticator failed for H=([197.255.200.204]) [197.255.200.204]:45384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 07:30:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<A4GqfPlGdMIv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 07:32:25 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54784: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 07:33:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5hfgiflGSIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 07:35:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<uCRQjvlGKjFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 07:36:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<zOeglPlGGu2ElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-28 07:36:59 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:58832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.80
country_id: 1269750
description:
2025-12-28 07:37:29 dovecot_login authenticator failed for H=([122.187.229.80]) [122.187.229.80]:36882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 07:41:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HGwOpflG5q0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-28 07:42:10 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:44046: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-28 07:42:45 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:49684: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.166
country_id: 6252001
description:
Dec 28 07:42:56 host2 pure-ftpd[3043165]: (?@20.65.194.166) [INFO] New connection from 20.65.194.166


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 07:43:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<CPzBq/lGDpOnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 07:43:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<huRurPlG5o6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 07:44:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<XC/ksPlGftqi8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.234.246.154
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.234.246.154 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.200.217.128
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.200.217.128 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.85.149
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.158.85.149 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.17.208
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 68.224.17.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.194.137.238
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.194.137.238 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.91.253.139
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.91.253.139 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.200.110
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 140.186.200.110 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.233.149.152
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.233.149.152 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.113.222
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 204.111.113.222 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.197.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.211.197.114 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 07:45:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8m47s/lGzImkXF7M>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.153.59.183
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 164.153.59.183 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.43.106
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.43.106 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.230.203
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.158.230.203 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.67.251.96
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.67.251.96 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 07:47:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZVq6uPlG4M9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 07:47:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<0yvjuPlGQoov/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:48:27 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<CGLpvflGZtIDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 07:51:16 host2 sshd[3050927]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-12-28 07:50:26 dovecot_login authenticator failed for H=([47.247.80.227]) [47.247.80.227]:60708: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2025-12-28 07:50:37 dovecot_login authenticator failed for H=([216.132.40.41]) [216.132.40.41]:48137: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:50:25 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<b977xPlGsLYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:51:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<A+ynyPlG5uUv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:51:55 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<NQdTyvlGgs0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:53:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<eqgLz/lGgqYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:53:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<eYwZ0flGftkv/lVz>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:53:24 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jfOhz/lGnIUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:53:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Q3vuz/lGcrUDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 07:54:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<bzCq0/lGgh9niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 07:54:42 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<cac/1PlG/pgDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 07:55:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mWRX1flGCOkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 07:55:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<mHHz1/lGkMbBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 07:56:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Tzqh2flGKdZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 07:57:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZUHu3PlGgNkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 07:57:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3x7S3flG0sqnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 07:59:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Ek+l5vlGMulA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 08:00:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<2CcB6PlG/KinrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 08:03:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<rHXr8vlGFshV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 08:03:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<d+CH8/lGBHinYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 08:03:56 host2 sshd[3061620]: Disconnected from invalid user  62.60.131.157 port 9626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-28 08:06:05 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42898: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-28 08:06:17 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:50467: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 08:07:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<A7jlAvpGWtcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 08:09:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<zu2UCfpGPJYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 08:11:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<e4UuEfpGLJcFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2025-12-28 08:12:13 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:60770: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 08:13:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<bmUgGPpGTNfJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 08:14:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zr2yGvpG2KAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 08:14:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<NrlFG/pGJoAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2025-12-28 08:16:35 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:41757: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2025-12-28 08:16:51 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:45096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 08:18:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<05CSJ/pGBNAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 08:19:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<CcbELPpGJMUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 08:20:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<+XSWMPpGbO0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 08:20:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JUWxMfpG8KIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 28 08:21:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, TLS, session=<qDCBNPpGEOY26lCA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 08:23:16 host2 pure-ftpd[3078135]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.198
country_id: 6252001
description:
Dec 28 08:23:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.198, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<mkOaO/pGc8ii2JbG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2025-12-28 08:23:49 dovecot_login authenticator failed for H=([122.187.223.255]) [182.79.52.114]:57414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 08:24:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<lLE9PvpGjsmi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-28 08:24:22 dovecot_login authenticator failed for H=([122.187.230.13]) [122.187.230.13]:44333: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.198
country_id: 6252001
description:
Dec 28 08:24:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.150.198, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PaHEP/pGIvmi2JbG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:27:16 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<yEDASPpGOokDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 08:27:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qszMSPpGsoho7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.216.1.252
country_id: 1861060
description:
Dec 28 08:28:00 host2 sshd[3082218]: Disconnected from invalid user ftpuser 8.216.1.252 port 39100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 28 08:28:09 host2 sshd[3082361]: Disconnected from invalid user admin2 178.128.92.222 port 58788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:29:53 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<SokXUvpGMoIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:30:07 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<S7XwUvpGttgDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 08:30:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<s8GsVPpGRM6ElEgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.198
country_id: 6252001
description:
Dec 28 08:31:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.198, lip=66.85.158.91, TLS, session=<shqrWPpGwvai2JbG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 113.193.234.210
country_id: 1269750
description:
Dec 28 08:31:16 host2 sshd[3084889]: Disconnected from invalid user dockeradmin 113.193.234.210 port 61266 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:31:40 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<o1V3WPpGCrYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.198
country_id: 6252001
description:
Dec 28 08:32:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.198, lip=66.85.158.91, TLS, session=<R5x3XPpGMPmi2JbG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 08:33:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BH+bXvpGkmIjupN+>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:33:24 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<rmWqXvpG9JkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:33:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<0RvIXvpGFpoDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.1.50
country_id: 1269750
description:
Dec 28 08:34:33 host2 sshd[3087580]: Disconnected from invalid user user33 45.121.1.50 port 3904 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 28 08:34:47 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Q4+kY/pGqKsDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.1.50
country_id: 1269750
description:
Dec 28 08:35:18 host2 sshd[3088469]: Disconnected from invalid user banana 45.121.1.50 port 29765 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 08:35:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+G6XZvpGssel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 08:35:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<DFuXZ/pG/tunrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 28 08:36:41 host2 sshd[3089447]: Disconnected from invalid user username 178.128.92.222 port 56544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.1.50
country_id: 1269750
description:
Dec 28 08:36:56 host2 sshd[3089620]: Disconnected from invalid user dockeradmin 45.121.1.50 port 9588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 08:37:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ZeCGbvpG/KqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 08:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DlbVbvpG7ocv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 28 08:38:00 host2 sshd[3090552]: Disconnected from invalid user teamspeak 178.128.92.222 port 45674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.61.57
country_id: 2215636
description:
Dec 28 08:38:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=165.16.61.57, lip=66.85.158.91, TLS, session=<NLk2bvpG6YmlED05>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 28 08:37:17 host2 sshd[3089916]: Disconnected from invalid user banana 178.128.92.222 port 55722 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.73.226
country_id: 3469034
description:
Dec 28 08:37:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.120.73.226, lip=66.85.158.91, TLS, session=<qIL8bPpGFd67eEni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 08:38:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<V/Wtb/pGqgei8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 28 08:38:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<xkfkcPpG0rOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 08:40:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<B6lcefpGUKFnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.1.58
country_id: 1269750
description:
Dec 28 08:43:08 host2 sshd[3095237]: Disconnected from invalid user ftpupload 45.121.1.58 port 46992 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Dec 28 08:44:48 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<ay1uh/pG1u0D7a3c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.1.58
country_id: 1269750
description:
Dec 28 08:45:30 host2 sshd[3098524]: Disconnected from invalid user admin2 45.121.1.58 port 17959 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.1.58
country_id: 1269750
description:
Dec 28 08:46:13 host2 sshd[3099882]: Disconnected from invalid user kumar 45.121.1.58 port 24659 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Dec 28 08:47:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.217, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PEKekPpGHNbG6xjZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 08:47:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<uByZj/pGzkAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 08:48:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Blr2k/pGOUxniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-28 08:48:38 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:58709: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 08:49:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<NdCdlvpGrLov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 08:49:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<QODGlvpGrqHBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 08:49:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<JOdxmfpG365100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 08:50:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<FUAAnfpGhIKnrEV8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - euroente "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 08:52:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<a+5NpPpGtsSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 08:53:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<JpBjpfpGCpqnrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 08:55:21 host2 sshd[3106942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-28 08:56:35 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:36488: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2025-12-28 08:56:55 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:38368: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-28 08:57:49 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:64052: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 08:57:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<mjiBtvpGKpRV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 08:58:02 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:37322: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 09:00:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<VwffwPpG2scv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 09:00:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<S7Mgv/pG2q5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 09:00:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<A8JHv/pG/NMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-28 09:03:34 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:57386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Dec 28 09:03:45 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.92, TLS, session=<GWY+y/pG6IZV2ZUV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 09:03:59 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:54122: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 28 09:04:02 host2 sshd[3113638]: Disconnected from invalid user git 154.113.10.34 port 48436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.7
country_id: 798549
description:
Dec 28 09:03:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.7, lip=66.85.158.92, session=<Sic0yvpGKtDUSZQH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:04:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8J8YzfpGZLwzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.208.164
country_id: 798544
description:
Dec 28 09:04:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=109.125.208.164, lip=66.85.158.91, TLS, session=<Ldi8zfpGxI9tfdCk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.207
country_id: 3865483
description:
Dec 28 09:05:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=179.0.250.207, lip=66.85.158.91, TLS, session=<cPLkzvpGmdOzAPrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 09:06:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<T2fC1PpGBNYFhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.138.58.85
country_id: 6252001
description:
[2025-12-28 09:07:17 +0530] info [cpaneld] 107.138.58.85 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.179.4.43
country_id: 6252001
description:
[2025-12-28 09:07:16 +0530] info [cpaneld] 98.179.4.43 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.219.127
country_id: 6252001
description:
[2025-12-28 09:07:18 +0530] info [whostmgrd] 172.59.219.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.69.56.44
country_id: 1694008
description:
Dec 28 09:07:26 host2 sshd[3116136]: Disconnected from invalid user miladmim 58.69.56.44 port 52384 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.225.110
country_id: 6252001
description:
[2025-12-28 09:07:26 +0530] info [cpaneld] 172.59.225.110 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.146.190.15
country_id: 6252001
description:
[2025-12-28 09:07:29 +0530] info [cpaneld] 71.146.190.15 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.242.51.105
country_id: 6252001
description:
[2025-12-28 09:07:31 +0530] info [cpaneld] 98.242.51.105 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.231.19.125
country_id: 6252001
description:
[2025-12-28 09:07:15 +0530] info [cpaneld] 162.231.19.125 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.176.255.186
country_id: 6252001
description:
[2025-12-28 09:07:32 +0530] info [cpaneld] 98.176.255.186 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.71.111.67
country_id: 6252001
description:
[2025-12-28 09:07:20 +0530] info [cpaneld] 173.71.111.67 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.236.147.22
country_id: 6252001
description:
[2025-12-28 09:07:25 +0530] info [cpaneld] 108.236.147.22 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:07:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<otuW2fpGBrwzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.208.240.3
country_id: 6252001
description:
[2025-12-28 09:07:19 +0530] info [cpaneld] 47.208.240.3 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.14.78.22
country_id: 6252001
description:
[2025-12-28 09:07:26 +0530] info [cpaneld] 172.14.78.22 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-28 09:07:16 +0530] info [cpaneld] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 28 09:07:13 host2 sshd[3115969]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 48014


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.238.255.159
country_id: 6252001
description:
[2025-12-28 09:07:22 +0530] info [cpaneld] 70.238.255.159 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.203.37
country_id: 6252001
description:
[2025-12-28 09:07:24 +0530] info [cpaneld] 172.59.203.37 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 09:08:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Sm8/3PpGxpkyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 28 09:10:04 host2 sshd[3118053]: Disconnected from invalid user seekcy 154.113.10.34 port 44976 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.234.75
country_id: 6252001
description:
Dec 28 09:09:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=206.189.234.75, lip=66.85.158.91, TLS, session=<Y3eW3vpGMrvOvepL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-28 09:09:24 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:41362: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-28 09:09:40 dovecot_login authenticator failed for H=(182.239.78.49.hk.chinamobile.com) [182.239.78.49]:44291: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.69.56.44
country_id: 1694008
description:
Dec 28 09:09:46 host2 sshd[3117700]: Disconnected from invalid user be 58.69.56.44 port 45314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.98.152
country_id: 1168579
description:
Dec 28 09:11:59 host2 sshd[3119586]: Disconnected from invalid user hb 111.68.98.152 port 50638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 09:11:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cE2J6PpGRugv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.98.152
country_id: 1168579
description:
Dec 28 09:12:36 host2 sshd[3120250]: Disconnected from invalid user shashi 111.68.98.152 port 54632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 28 09:12:45 host2 sshd[3120326]: Disconnected from invalid user ollama 154.113.10.34 port 42042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 09:12:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<So5d6/pGXLYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 09:13:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<dkNm7vpG2MEvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 09:14:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<QmIo8/pG0s6i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Dec 28 09:15:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, TLS: Connection closed, session=<7ZHc9fpGZrZChJmB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 09:19:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<wHRBA/tGOvdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 28 09:22:13 host2 sshd[3127272]: Disconnected from invalid user git 165.154.97.28 port 52600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 28 09:23:17 host2 sshd[3128016]: Disconnected from invalid user ubuntu 165.154.97.28 port 51542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-28 09:23:39 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:43412: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 09:24:03 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:46302: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 09:25:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<0wbwGftGRq+ElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 09:26:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LwvYGvtGTNMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 09:26:16 host2 pure-ftpd[3130426]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-28 09:27:38 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:51552: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2025-12-28 09:27:54 dovecot_login authenticator failed for H=([122.187.230.81]) [122.187.230.81]:48293: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 09:28:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<G7G1IvtG2uul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 09:28:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gT87JPtGaZ5100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.109
country_id: 6252001
description:
Dec 28 09:28:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=98.80.4.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XHx4JftGAMFiUARt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.109
country_id: 6252001
description:
Dec 28 09:29:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.80.4.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<v7QLJvtG3rpiUARt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 09:29:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E0VBJvtGhLUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 28 09:29:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<fQbZJvtGRN8FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 09:29:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<5f2FJ/tG+o+nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 09:31:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<RGb8LPtG9tKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 09:31:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PlhxLvtGJh6i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 09:33:37 host2 sshd[3136235]: Disconnected from invalid user  62.60.131.157 port 20301 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 09:35:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<DCqOPPtGnJFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.201
country_id: 6290252
description:
Dec 28 09:37:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=109.207.35.201, lip=66.85.158.91, TLS, session=</vz8QvtGV6RtzyPJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 28 09:37:44 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<z/e7RPtGzsE26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.97.28
country_id: 1819730
description:
Dec 28 09:37:44 host2 sshd[3139674]: Disconnected from invalid user xtest 165.154.97.28 port 48496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.112.9
country_id: 3469034
description:
Dec 28 09:37:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.39.112.9, lip=66.85.158.91, TLS, session=<dasYRPtGRJWxJ3AJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 09:38:47 host2 sshd[3140657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 09:39:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QEqZTPtG0I0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.87.107.193
country_id: 1269750
description:
Dec 28 09:41:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.87.107.193, lip=66.85.158.91, TLS, session=<5LnzT/tGA5xnV2vB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.48
country_id: 2300660
description:
Dec 28 09:41:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.11.48, lip=66.85.158.91, TLS, session=<2Nk0UftGw8opiwsw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 09:41:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gu7UU/tGxJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 09:42:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<kz74VvtGxMzBl4nP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:24 host2 sshd[3144614]: error: maximum authentication attempts exceeded for invalid user admin from 62.169.238.187 port 56350 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:27 host2 sshd[3144640]: Disconnecting invalid user admin 62.169.238.187 port 54058: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 09:43:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<M9TBWvtGclSnYwhf>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:13 host2 sshd[3144454]: Disconnecting authenticating user root 62.169.238.187 port 39176: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.169.238.187
country_id: 390903
description:
Dec 28 09:43:13 host2 sshd[3144454]: error: maximum authentication attempts exceeded for root from 62.169.238.187 port 39176 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 09:43:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LQ+BWPtGvwtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 09:46:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<sb+MYvtG+ounrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 09:47:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QKp/ZvtGouunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-28 09:47:19 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:36921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-28 09:47:38 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:62878: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 09:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0aRqe/tGHodV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 09:52:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<4zS1ePtGkrQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2025-12-28 09:54:05 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:48650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:54:33 host2 sshd[3154305]: Disconnected from invalid user titan 154.83.15.92 port 56484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 09:54:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<auZIgftGpr0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:55:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QWt3g/tGdJAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:58:05 host2 sshd[3157028]: Disconnected from invalid user pal 154.83.15.92 port 41518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 09:58:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<S04HkPtGULozTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 09:59:22 host2 sshd[3157931]: Disconnected from invalid user boss 154.83.15.92 port 41174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-28 09:59:24 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:50436: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Dec 28 10:00:06 host2 sshd[3158598]: Disconnected from invalid user red 154.83.15.92 port 55124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 10:01:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GEPXmftG1J0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 10:03:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<GDERoftG/KkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:03:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<CjR2oftGjLkv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.32.140
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.32.140 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 10:05:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<MWzxqPtGioai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 10:06:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<N4j1q/tG7qsv7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:13 host2 pure-ftpd[3163994]: (?@85.217.149.20) [INFO] New connection from 85.217.149.20


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 28 10:07:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, session=<cdVKrvtGSotV2YwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.91, TLS: Connection closed, session=<n6uRrvtGdJZV2ZUU>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.20
country_id: 798549
description:
Dec 28 10:07:29 host2 pure-ftpd[3164164]: (?@85.217.149.20) [INFO] New connection from 85.217.149.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 10:07:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<JguPsPtG1JgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 10:09:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<30YRt/tGOqpA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 28 10:11:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.91, TLS: Connection closed, session=<KRU3vftGsJYfDiAG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 10:18:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6wb/1/tGkIUjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 10:18:17 host2 sshd[3172514]: Disconnected from invalid user markus 62.60.131.157 port 17673 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:21:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1eX03/tGmsYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 10:21:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<g2Rt4PtG2mZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 10:21:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<1Cf04PtGtoWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 10:22:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<yCHK4/tGKJCElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 10:24:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bDc36vtGBIakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 10:24:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<86BZ6vtGns2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 10:24:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<swNv7ftG3JGi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:25:19 host2 sshd[3177851]: Disconnected from invalid user john 51.91.252.38 port 48846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:25:53 host2 sshd[3178184]: Disconnected from invalid user openbravo 51.91.252.38 port 45084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Dec 28 10:26:29 host2 sshd[3178686]: Disconnected from invalid user virtualbox 51.91.252.38 port 40374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-28 10:28:17 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:40196: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:28:30 host2 sshd[3179983]: Disconnected from invalid user mohamed 118.194.230.231 port 40958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-12-28 10:28:31 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:45502: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.30.199
country_id: 6252001
description:
2025-12-28 10:28:54 dovecot_login authenticator failed for H=ool-43531ec7.dyn.optonline.net [67.83.30.199]:56947: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 10:29:08 host2 pure-ftpd[3180546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 28 10:29:41 host2 sshd[3180878]: Disconnected from invalid user john 93.71.118.99 port 37540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-28 10:29:14 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:46186: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 28 10:29:29 host2 sshd[3180726]: Disconnected from invalid user david 101.36.108.134 port 60628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 10:30:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<j+AJAfxGAKFnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 28 10:30:49 host2 sshd[3181800]: Disconnected from invalid user user11 138.124.158.147 port 42698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:30:55 host2 sshd[3181862]: Disconnected from invalid user admin 118.194.230.231 port 41142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 28 10:32:33 host2 sshd[3183066]: Disconnected from invalid user infra 118.194.230.231 port 41284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 10:32:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zze3CfxGiGEjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Dec 28 10:32:25 host2 sshd[3182951]: Disconnected from invalid user deploy 101.36.108.134 port 49312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 10:34:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XQZMEPxGZPmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 10:35:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<euyQE/xGEOov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.30.104
country_id: 933860
description:
Dec 28 10:36:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=83.143.30.104, lip=66.85.158.91, TLS, session=<vP0dF/xGn8pTjx5o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 10:36:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<JJ2HGPxG6TNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 10:37:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<EUeDG/xGlujBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.214
country_id: 3865483
description:
Dec 28 10:37:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=181.191.223.214, lip=66.85.158.91, TLS, session=<QualGPxGwcG1v9/W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.221
country_id: 3175395
description:
Dec 28 10:40:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.221, lip=66.85.158.91, TLS, session=<D+PZJPxG06nZGrPd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.178.136
country_id: 3175395
description:
Dec 28 10:40:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.178.136, lip=66.85.158.91, TLS, session=<+B/FI/xGGY7ZGrKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 10:41:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9SVnKfxGap6nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 10:42:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<cUnWKvxGGuWnrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 10:42:54 host2 sshd[3190453]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 10:43:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<RtdeMPxGRpMuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2025-12-28 10:44:48 dovecot_login authenticator failed for H=([122.187.223.78]) [182.66.214.34]:40054: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-28 10:45:46 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:51403: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Dec 28 10:45:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS, session=<8Vq3OPxGAOLN0h9Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.44
country_id: 6252001
description:
Dec 28 10:46:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.44, lip=66.85.158.91, session=<x7v8OPxG7OLG6xgs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 10:46:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<KZ6TO/xG2KozTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.128.65.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.128.65.57 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 10:47:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54177: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-28 10:48:24 dovecot_login authenticator failed for H=([197.219.208.38]) [197.219.208.38]:47270: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 10:48:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<sK++QfxGuKFV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 10:48:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uCTdQfxG1p0v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2025-12-28 10:48:53 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:47394: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2025-12-28 10:50:03 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:39464: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 10:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<BNprSPxGppszTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.128.65.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 23.128.65.88 - simpleengineerin "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 10:56:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JtiqXfxGypAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 10:56:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ejD6XvxGQLei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 10:57:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<wyYFYvxGEpUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 10:59:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2hQQafxGgKoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:00:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DSWMbPxGxosv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.2.69
country_id: 6251999
description:
Dec 28 11:00:58 host2 sshd[3204195]: Disconnected from invalid user docker 159.203.2.69 port 56788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-28 11:01:01 dovecot_login authenticator failed for H=([122.187.223.252]) [122.186.202.10]:50426: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 177.136.229.18 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-28 11:01:43 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-28 11:02:01 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (onpres) [73.213.236.66]:59894: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 11:02:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<RHIWdfxGlMBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 11:02:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OfIYdfxG1N8vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 11:02:59 host2 sshd[3205756]: Disconnected from invalid user  62.60.131.157 port 50436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-28 11:02:11 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:37607: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:02:32 host2 sshd[3205460]: Disconnected from invalid user steam 43.133.148.170 port 57586 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 177.136.229.18 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.136.229.18
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 177.136.229.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 11:06:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<q3ttgPxG+GZo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:06:17 host2 sshd[3208372]: Disconnected from invalid user ali 43.133.148.170 port 37606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:07:02 host2 sshd[3208949]: Disconnected from invalid user testuser 43.133.148.170 port 34454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:07:40 host2 sshd[3209352]: Disconnected from invalid user ansible 43.133.148.170 port 50914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 28 11:10:42 host2 sshd[3211909]: Disconnected from invalid user admin 43.133.148.170 port 42588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-28 11:12:02 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:24055: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.219.172.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.219.172.19 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.206.26
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 75.4.206.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.26.7
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.30.26.7 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.40.110
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.181.40.110 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.166.165
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.166.165 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.171.137.245
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.171.137.245 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-28 11:12:24 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:42786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 11:12:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kcc5l/xGXIsjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.254.198
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 207.135.254.198 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.88.156.187
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.88.156.187 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.109.206.85
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.109.206.85 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.247.203
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.37.247.203 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.1.36.62
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.1.36.62 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.124.23.54
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 52.124.23.54 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.142.7.37
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.142.7.37 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.37
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.16.37 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 11:13:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jNGwnPxGnrcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 11:14:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<X6VBoPxGiLh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 11:14:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<89wKoPxGKsal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 11:17:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<b31oqfxGtpWkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 11:19:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9PwKsPxGmsyi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.247
country_id: 6252001
description:
Dec 28 11:19:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=147.185.133.247, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CfxosPxG+uiTuYX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 11:19:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<spoHsvxGPN6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 11:20:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<ckA/s/xGpt+ElEgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.48
country_id: 6252001
description:
Dec 28 11:21:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.48, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rVibufxGYrASYQUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.173
country_id: 6252001
description:
Dec 28 11:21:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.173, lip=66.85.158.92, session=<mYQat/xGwqEs3Lyt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.203.2.69
country_id: 6251999
description:
Dec 28 11:23:04 host2 sshd[3221599]: Disconnected from invalid user admin 159.203.2.69 port 43038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 50.18.30.174
country_id: 6252001
description:
Dec 28 11:23:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=50.18.30.174, lip=66.85.158.91, TLS: Connection closed, session=<9W0YvvxGVqcyEh6u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.57.30.225
country_id: 6252001
description:
Dec 28 11:23:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.57.30.225, lip=66.85.158.92, TLS: Connection closed, session=<xt2rwPxGhIgNOR7h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:24:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YdnjwPxGcJrPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:24:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: Connection closed, session=<9wN4wfxGLL3PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.247
country_id: 6252001
description:
Dec 28 11:24:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.247, lip=66.85.158.92, TLS, session=<HvILxPxGCvKTuYX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-28 11:25:45 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:60751: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 11:25:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7WSax/xGYINnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 11:25:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<7R+kx/xG+NunYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-28 11:26:00 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:41044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 11:26:29 host2 sshd[3224105]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 11:26:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dpO0yfxGPoUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-28 11:26:36 dovecot_login authenticator failed for H=78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:36068: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-28 11:26:57 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:59306: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 11:29:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<53cX1vxGiMkv+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 11:32:06 host2 pure-ftpd[3228149]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:32:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<7wXl4PxGAq7PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 28 11:33:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: Connection closed, session=<5i6r4fxG+q3PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 11:36:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<5que6/xG3O0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 11:36:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<LP+y6/xGspDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.138
country_id: 226074
description:
Dec 28 11:35:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=196.0.87.138, lip=66.85.158.91, TLS, session=<NxAv6vxGcLzEAFeK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.70
country_id: 1269750
description:
Dec 28 11:36:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=103.18.166.70, lip=66.85.158.91, TLS, session=<H25x6/xGhOtnEqZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 11:37:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9km98PxGsN2nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 11:38:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KB2x9PxG6t2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 11:39:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<SoTR9/xGHM4zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.179.188.238
country_id: 3469034
description:
Dec 28 11:39:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=45.179.188.238, lip=66.85.158.91, TLS, session=<vp8q9/xG2e0ts7zu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.97
country_id: 3996063
description:
Dec 28 11:39:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=38.65.137.97, lip=66.85.158.91, TLS, session=<bKhy+PxGgoUmQYlh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.83
country_id: 1269750
description:
2025-12-28 11:41:55 dovecot_login authenticator failed for H=([122.187.230.83]) [122.187.230.83]:32982: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-28 11:42:13 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:59566: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-28 11:42:28 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:47573: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:42:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7XdpA/1Glo4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-28 11:43:05 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:50244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 11:43:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<HBfXBP1GNtMzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-28 11:43:30 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:43694: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-28 11:43:59 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:43972: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-28 11:43:25 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:43600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 11:45:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<f5fNC/1G7NtV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 28 11:46:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<hop9Ef1GxHJChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 11:47:29 host2 sshd[3242288]: Disconnected from invalid user maci 62.60.131.157 port 26787 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 28 11:47:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<MRFiFf1GbvVChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 11:48:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tnHDFv1GuMWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 11:49:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<M+5RG/1GRrAv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-28 11:53:42 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:35532: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 11:53:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ArrpK/1GasQFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 28 11:53:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.92, TLS: Connection closed, session=<zeLsKf1GgK2VHDF7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-28 11:54:25 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:55791: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 24.144.92.201
country_id: 6252001
description:
Dec 28 11:54:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=24.144.92.201, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<hMmzLv1GvNsYkFzJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 11:54:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<E06gLv1GeOwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-28 11:56:53 dovecot_login authenticator failed for H=(201.173.56.28-clientes-izzi.mx) [201.173.56.28]:60848: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-28 11:57:02 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:38216: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 11:57:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<8PPrNv1GYssyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 11:59:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<TDazP/1GVrsvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.66
country_id: 6252001
description:
Dec 28 11:59:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LHs5Qf1Gj8zN0h9C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 12:00:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WwHsQv1GMmxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-28 12:01:05 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-28 12:01:34 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:53318: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:04:13 host2 sshd[3256985]: Disconnected from invalid user karim 20.12.41.6 port 59406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 12:05:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<E+hIU/1GFIhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-28 12:05:11 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:34364: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.23.217
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.23.217 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.215.183.191
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.215.183.191 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.224.173.151
country_id: 3175395
description:
2025-12-28 12:05:56 dovecot_login authenticator failed for H=([83.224.173.151]) [83.224.173.151]:39962: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.206.227.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.206.227.89 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.203.108.100
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.203.108.100 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:05:47 host2 sshd[3258403]: Disconnected from invalid user gitlab-runner 20.12.41.6 port 42798 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.216.143.226
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.216.143.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.151.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.243.151.57 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.131.159 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.30.231.126
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.30.231.126 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.92.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.155.92.244 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.132
country_id: 6252001
description:
Dec 28 12:05:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.132, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<e8E1Vf1GCc+TuYSE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.24.188.196
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.24.188.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.124.173.220
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.124.173.220 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.80.245
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 68.230.80.245 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.137.191.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.137.191.162 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.109.42
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.109.42 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 12:06:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UPrTWP1GdOUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 12:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<m8mcW/1GRLEv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Dec 28 12:07:34 host2 sshd[3259765]: Disconnected from invalid user git 20.12.41.6 port 35960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 12:09:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<qFkkYv1GRqGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 12:10:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dm3SZ/1GFIh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 12:12:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</cV2bP1GhICkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 12:13:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<oMhScf1GEOxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 12:14:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qKrVdf1GKpii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 12:17:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<E7Ywgf1G1DmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 12:17:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<mTYbgf1GFoynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 12:19:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<ub2mh/1GcsCElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 12:20:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fXu6i/1GxKUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 12:22:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<66q9kP1GMolnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 12:25:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<NfQcm/1GcKov+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.25.184
country_id: 1522867
description:
2025-12-28 12:26:32 dovecot_login authenticator failed for H=2.135.25.184.dynamic.telecom.kz [2.135.25.184]:56164: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-28 12:26:50 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:48156: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 12:29:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Vfwpqv1GyOYuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 12:30:44 host2 sshd[3277219]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.192.245
country_id: 6252001
description:
Dec 28 12:30:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.192.245, lip=66.85.158.91, session=<ytCcrf1GvuxK+cD1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2025-12-28 12:31:01 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:34497: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.44.137.178
country_id: 798549
description:
2025-12-28 12:31:23 dovecot_login authenticator failed for H=([89.44.137.178]) [89.44.137.178]:41426: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 12:33:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<OD6Yt/1GEOYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 12:33:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<ujsQuv1G5J+nrEV8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 12:35:06 host2 pure-ftpd[3280533]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 12:34:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<gXdkvf1GdunBl4nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.144
country_id: 6252001
description:
Dec 28 12:35:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=199.45.154.144, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<Reu1v/1GwtzHLZqQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 12:36:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<aC/CxP1GBIczTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 12:36:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<qvmWxf1GUMynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 12:37:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Kw8lxv1G2u0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:37:37 host2 sshd[3282868]: Disconnected from invalid user amir 85.18.236.229 port 42922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 12:38:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XnIIzP1GkkVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:39:18 host2 sshd[3284498]: Disconnected from invalid user user 85.18.236.229 port 44142 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 28 12:39:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<0Ipvzv1GwowsyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 12:39:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jQHBz/1GDO6i8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:39:49 host2 sshd[3285042]: Disconnected from invalid user ubuntu 85.18.236.229 port 55948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:40:50 host2 sshd[3286183]: Disconnected from invalid user git 85.18.236.229 port 51328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.200
country_id: 2413451
description:
2025-12-28 12:41:26 dovecot_login authenticator failed for H=([197.255.199.200]) [197.255.199.200]:36333: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-28 12:41:48 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:15475: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 28 12:42:26 host2 sshd[3287734]: Disconnected from invalid user steam 85.18.236.229 port 58524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 12:42:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iKLz2v1Gzr8v/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.109.215.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 208.109.215.6 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:43:30 host2 sshd[3288853]: Disconnected from invalid user user 74.48.141.135 port 35768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Dec 28 12:43:31 host2 sshd[3288840]: Disconnected from invalid user git 186.86.52.137 port 21827 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-28 12:44:23 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36566: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 12:44:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<Nw/74P1GzqDJvgxi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.86.52.137
country_id: 3686110
description:
Dec 28 12:44:44 host2 sshd[3290035]: Disconnected from invalid user user 186.86.52.137 port 8311 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2025-12-28 12:44:54 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:48224: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.194
country_id: 2510769
description:
Dec 28 12:46:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=139.28.190.194, lip=66.85.158.91, TLS, session=<QAF/5f1GdM+LHL7C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.129
country_id: 3175395
description:
Dec 28 12:46:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.15.168.129, lip=66.85.158.91, TLS, session=<KbCJ5v1GNIm5D6iB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.210
country_id: 6252001
description:
Dec 28 12:47:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.210, lip=66.85.158.92, session=<kXdJ6/1GLOOTuYTS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:48:03 host2 sshd[3293766]: Disconnected from invalid user admin 74.48.141.135 port 46146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.141.135
country_id: 6252001
description:
Dec 28 12:48:35 host2 sshd[3294254]: Disconnected from invalid user jenkins 74.48.141.135 port 53292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 12:49:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<vP088f1GkNsv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-28 12:48:20 dovecot_login authenticator failed for H=(173-25-186-130.client.mchsi.com) [173.25.186.130]:50656: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-28 12:48:30 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:53520: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.246.210.57
country_id: 798544
description:
Dec 28 12:49:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=91.246.210.57, lip=66.85.158.91, TLS, session=<zc+h8f1GcsJb9tI5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.60
country_id: 2963597
description:
Dec 28 12:49:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.203.48.60, lip=66.85.158.91, TLS, session=<F2+z8v1GpNQlyzA8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 12:51:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<KkCI+P1GgtkFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.78
country_id: 6252001
description:
Dec 28 12:53:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.78, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P4gf//1GTtaTuYRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 12:55:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<soTgB/5G4sxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 12:55:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<K51RCP5Gyo0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 12:56:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<CEgwDf5GPpgvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-28 12:59:07 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:42804: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-12-28 12:58:37 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:52100: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<yzXUGv5GDKwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:00:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kw0VG/5GDLcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 13:03:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<208/I/5G+qal6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 28 13:04:49 host2 pure-ftpd[3308534]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:05:23 host2 sshd[3309131]: Disconnected from invalid user admin 103.26.136.173 port 45380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:06:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KvHiL/5GapoDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 13:06:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bKYZMP5GNKSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 13:07:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<RZ2eMf5GLoNA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:07:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<HvIRNP5GLK0DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 13:07:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<J97vMf5GivB100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 28 13:07:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<owH1Mv5Gjs4D7r/l>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:08:18 host2 sshd[3311672]: Disconnected from invalid user ftpuser 103.26.136.173 port 43886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:08:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jFfGNv5GJoEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.153.206
country_id: 6252001
description:
Dec 28 13:08:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.84.153.206, lip=66.85.158.92, session=<tzH0N/5G+KkUVJnO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:10:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<nUzgPv5G3pIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:11:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+b3uP/5GIM8DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec 28 13:11:41 host2 sshd[3315116]: Disconnected from invalid user ubuntu 103.26.136.173 port 56116 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:13:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<QE6XSf5GSuMDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 13:14:24 host2 sshd[3318293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Dec 28 13:14:12 host2 pure-ftpd[3318138]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 28 13:14:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<MkN6TP5GSo4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:14:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sKePTf5Gir4jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 217.172.189.13 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 13:16:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<t0K+VP5GvM6nrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 13:16:13 host2 sshd[3319879]: Disconnected from invalid user 1234 62.60.131.157 port 8631 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2025-12-28 13:16:27 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:45666: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 13:18:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<aWNiWf5GKopnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 13:19:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<PX0kXv5GjKGElEgp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.9
country_id: 2264397
description:
Dec 28 13:19:56 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.9, lip=66.85.158.91, session=<2TNiX/5Gs9xtadEJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.7
country_id: 2264397
description:
Dec 28 13:19:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.209.7, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5vtqX/5GjtptadEH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.10
country_id: 2264397
description:
Dec 28 13:20:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=109.105.209.10, lip=66.85.158.91, TLS, session=<7BKdX/5GCcRtadEK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.8
country_id: 2264397
description:
Dec 28 13:20:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.209.8, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<8eLqX/5G/b9tadEI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 13:20:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<pXb9X/5GBosv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 13:22:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<X5X5Zv5GpNYuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 28 13:22:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<F9ipZ/5G8genXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-28 13:23:58 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:48126: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 13:26:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EdFkd/5GprEzTcpt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 28 13:27:16 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS, session=<njSoef5Gj8K594lR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-28 13:29:43 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:57240: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-28 13:29:47 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:32790: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2025-12-28 13:29:55 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:36458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-28 13:29:14 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:63156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 13:30:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<s4oNhP5GsumnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 13:30:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QT+RhP5GJN0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 13:31:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<crOziP5GoN0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 13:31:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jgWxiP5GVBJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 13:31:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<T9zvh/5G4p2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 13:33:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=</Bp5jv5G5OrBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 13:36:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<QQgAmf5GYMSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:36:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1jIkm/5GNrYv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 13:37:59 host2 pure-ftpd[3336147]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-28 13:40:02 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:47246: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-28 13:39:49 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:57736: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 28 13:41:24 host2 pure-ftpd[3339161]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-28 13:42:39 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:4884: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-12-28 13:42:55 dovecot_login authenticator failed for H=([128.185.242.74]) [128.185.242.74]:42736: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 13:43:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<4i/Js/5G/Msv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec 28 13:43:24 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<C7BNs/5GLJU2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-28 13:45:18 dovecot_login authenticator failed for H=(bVVwC7Il) [69.5.189.21]:62198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-28 13:46:15 dovecot_login authenticator failed for H=(F5vGDJC) [69.5.189.21]:54475: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 13:48:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<sgTfxP5GFKcFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-28 13:49:11 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:33192: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.27
country_id: 3469034
description:
Dec 28 13:49:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=138.36.202.27, lip=66.85.158.91, TLS, session=</tv6xv5GAMSKJMob>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.84.115.34
country_id: 3469034
description:
Dec 28 13:49:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=189.84.115.34, lip=66.85.158.91, TLS, session=<WiO8yP5GCBC9VHMi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 13:49:40 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:52508: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 13:50:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jbzrzf5GxIVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 13:54:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iw012/5GNtwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 13:54:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<sqlF2/5GHMEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.231
country_id: 3175395
description:
Dec 28 13:54:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.15.170.231, lip=66.85.158.91, TLS, session=<k1aL2v5GlqC5D6rn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 13:54:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<AGVd3P5GznYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 13:55:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<sjTD3P5GuOQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.19.188
country_id: 1269750
description:
Dec 28 13:55:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=103.164.19.188, lip=66.85.158.91, TLS, session=<u43y2/5GMYtnpBO8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 13:56:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<6R6H4/5GKoml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 14:01:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WNye8v5GrCSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 14:01:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<QKiJ8v5GDuukXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-28 14:02:49 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:41418: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 14:03:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zP1S+/5GXkx100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 14:05:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<wj+aAP9GgF6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 14:09:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SJcMD/9GBOwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 14:09:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<l6gZEf9GRoxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 14:12:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53569: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 14:12:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<0OlVHP9GAt1nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-28 14:13:21 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:46381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-28 14:13:36 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:35404: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.127.36.21
country_id: 2395170
description:
Dec 28 14:14:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=154.127.36.21, lip=66.85.158.91, TLS, session=<i6HqIf9G44iafyQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 14:14:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rPqHI/9GgL6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.14
country_id: 798544
description:
Dec 28 14:14:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.231.121.14, lip=66.85.158.91, TLS, session=<njsiI/9GxpVb53kO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 14:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<tU2bJ/9GAt0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 14:15:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yNtgJf9Gls8uZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-28 14:15:24 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (ruerativer) [68.40.189.43]:56200: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 14:18:39 host2 sshd[3369621]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 14:18:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<lfWTL/9G/OlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 14:19:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<rdvBM/9GzoaElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 14:20:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8yYKOP9GDsgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 14:23:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<8VjjQf9GaJ2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 14:24:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<zKuFRf9G3ugzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 14:24:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8IEpR/9GIwZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 14:25:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sHnvSv9GBNAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 14:26:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Fkn5Tf9GysenrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.98
country_id: 6252001
description:
Dec 28 14:30:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7uBYXP9GptfG6xhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 14:30:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<2HVpXP9G8Ogv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 14:30:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<b8IxW/9GFqbBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 14:33:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<l/PbZv9GeqCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 14:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sT1Sdv9Gir4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-28 14:39:14 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:60782: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 14:40:57 host2 pure-ftpd[3388228]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-28 14:41:49 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48532: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:42:50 host2 sshd[3389963]: Disconnected from invalid user ftpuser 188.166.156.169 port 40500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-28 14:42:34 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:57642: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 14:44:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ywxKjf9G4NYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:45:43 host2 sshd[3392849]: Disconnected from invalid user user 152.32.131.195 port 43334 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:45:45 host2 sshd[3392880]: Received disconnect from 188.166.156.169 port 41270:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-12-28 14:46:37 dovecot_login authenticator failed for H=([196.190.180.18]) [196.190.180.19]:10834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 14:46:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jQWJlf9GpLRo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 28 14:47:10 host2 sshd[3394036]: Disconnected from invalid user ubuntu 188.166.156.169 port 55312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-28 14:47:22 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:49874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:47:25 host2 sshd[3394218]: Disconnected from invalid user new 152.32.131.195 port 43832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 14:48:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<sMhAnf9G4twv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.242.250.76
country_id: 6252001
description:
[2025-12-28 14:49:48 +0530] info [cpaneld] 97.242.250.76 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.38.152
country_id: 6252001
description:
[2025-12-28 14:49:52 +0530] info [cpaneld] 73.116.38.152 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.114.249
country_id: 6252001
description:
[2025-12-28 14:49:58 +0530] info [cpaneld] 75.207.114.249 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.218.67.54
country_id: 6252001
description:
[2025-12-28 14:49:59 +0530] info [cpaneld] 67.218.67.54 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.27.255.79
country_id: 6252001
description:
[2025-12-28 14:50:04 +0530] info [cpaneld] 199.27.255.79 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.217.112.114
country_id: 6252001
description:
[2025-12-28 14:49:45 +0530] info [cpaneld] 72.217.112.114 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.23.120.159
country_id: 6252001
description:
[2025-12-28 14:49:49 +0530] info [whostmgrd] 45.23.120.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.185.228
country_id: 6252001
description:
[2025-12-28 14:49:56 +0530] info [cpaneld] 96.241.185.228 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.192.67.4
country_id: 6252001
description:
[2025-12-28 14:49:55 +0530] info [cpaneld] 107.192.67.4 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.34.224.173
country_id: 6252001
description:
[2025-12-28 14:49:57 +0530] info [cpaneld] 65.34.224.173 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Dec 28 14:49:45 host2 sshd[3396636]: Disconnected from invalid user es 152.32.131.195 port 34756 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.44.147.199
country_id: 6252001
description:
[2025-12-28 14:49:46 +0530] info [cpaneld] 108.44.147.199 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 14:49:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MN3pnv9GiMojupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.193.205.225
country_id: 6252001
description:
[2025-12-28 14:50:08 +0530] info [cpaneld] 141.193.205.225 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.38.216
country_id: 6252001
description:
[2025-12-28 14:50:09 +0530] info [cpaneld] 73.231.38.216 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.234.148.42
country_id: 6252001
description:
[2025-12-28 14:50:13 +0530] info [cpaneld] 68.234.148.42 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:50:40 host2 sshd[3397628]: Disconnected from invalid user ftpuser 172.191.239.155 port 42690 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 14:51:22 host2 sshd[3398123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 14:51:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ChP2pf9Gdqul6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:52:28 host2 sshd[3398965]: Disconnected from invalid user tan 172.191.239.155 port 45998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.208.140
country_id: 3144096
description:
2025-12-28 14:52:36 dovecot_login authenticator failed for H=(cm-84.210.208.140.get.no) [84.210.208.140]:47377: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:52:44 host2 sshd[3399188]: Disconnected from invalid user it 209.15.115.240 port 52524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:53:25 host2 sshd[3399721]: Disconnected from invalid user fw 36.95.194.52 port 47144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 14:53:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<crUArv9GiDCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 14:53:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<FyZyrv9GJMQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 14:54:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<7prgr/9GMMUyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 14:55:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JF2qs/9G6MykXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:55:38 host2 sshd[3401670]: Disconnected from invalid user ubuntu 172.191.239.155 port 46004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:55:48 host2 sshd[3401784]: Disconnected from invalid user alexis 36.95.194.52 port 35074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 28 14:56:15 host2 sshd[3402164]: Disconnected from invalid user alexis 172.191.239.155 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:56:27 host2 sshd[3402287]: Disconnected from invalid user ubuntu 209.15.115.240 port 39628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 28 14:57:36 host2 sshd[3403238]: Disconnected from invalid user yang 36.95.194.52 port 47276 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.99.209
country_id: 6252001
description:
[2025-12-28 14:58:15 +0530] info [whostmgrd] 71.202.99.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.24.104.12
country_id: 6252001
description:
[2025-12-28 14:58:13 +0530] info [cpaneld] 136.24.104.12 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.66.54.58
country_id: 6252001
description:
[2025-12-28 14:58:17 +0530] info [cpaneld] 75.66.54.58 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.217.235.50
country_id: 6252001
description:
[2025-12-28 14:58:19 +0530] info [cpaneld] 97.217.235.50 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.60.161.123
country_id: 6252001
description:
[2025-12-28 14:58:11 +0530] info [cpaneld] 96.60.161.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.239.108.97
country_id: 6252001
description:
[2025-12-28 14:58:18 +0530] info [cpaneld] 162.239.108.97 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.214.65.177
country_id: 6252001
description:
[2025-12-28 14:58:27 +0530] info [cpaneld] 65.214.65.177 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 28 14:58:33 host2 sshd[3404329]: Disconnected from invalid user deploy 43.155.21.198 port 34206 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.113.159.177
country_id: 6252001
description:
[2025-12-28 14:58:12 +0530] info [cpaneld] 207.113.159.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.104.121.203
country_id: 6252001
description:
[2025-12-28 14:58:21 +0530] info [cpaneld] 72.104.121.203 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.75.209.104
country_id: 6252001
description:
[2025-12-28 14:58:23 +0530] info [cpaneld] 12.75.209.104 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.28.82.171
country_id: 6252001
description:
[2025-12-28 14:58:24 +0530] info [cpaneld] 108.28.82.171 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.212.14
country_id: 6252001
description:
[2025-12-28 14:58:26 +0530] info [cpaneld] 172.58.212.14 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.47.155.83
country_id: 6252001
description:
[2025-12-28 14:58:28 +0530] info [cpaneld] 24.47.155.83 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.72.53.207
country_id: 6252001
description:
[2025-12-28 14:58:20 +0530] info [cpaneld] 173.72.53.207 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 14:59:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<0Q0nxP9GBG+i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec 28 14:59:32 host2 sshd[3405197]: Disconnected from invalid user ftpuser 209.15.115.240 port 56194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:00:41 host2 sshd[3406271]: Disconnected from invalid user ubuntu 190.153.249.99 port 36946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:00:43 host2 sshd[3406301]: Disconnected from invalid user frontend 161.132.89.53 port 40296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 28 15:01:04 host2 sshd[3406503]: Disconnected from invalid user admin 43.155.21.198 port 34132 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 15:02:21 host2 sshd[3407733]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:02:39 host2 sshd[3408062]: Disconnected from invalid user newuser 161.132.89.53 port 48668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:04:00 host2 sshd[3409445]: Disconnected from invalid user postfixtester 190.153.249.99 port 38603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:04:06 host2 sshd[3409538]: Disconnected from invalid user rapid 103.226.139.139 port 48568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Dec 28 15:03:15 host2 sshd[3408806]: Disconnected from invalid user xm 161.132.89.53 port 60854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Dec 28 15:03:24 host2 sshd[3408982]: Disconnected from invalid user user2 190.153.249.99 port 60860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:03:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RNa50f9GuGEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:03:43 host2 sshd[3409234]: Disconnected from invalid user test6 137.184.30.179 port 34092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:04:11 host2 sshd[3409628]: Disconnected from invalid user ubuntu 137.184.30.179 port 44392 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-28 15:05:28 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:48992: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:05:34 host2 sshd[3410832]: Disconnected from invalid user java 103.226.139.139 port 45990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:05:37 host2 sshd[3410922]: Disconnected from invalid user loki 137.184.30.179 port 60078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2025-12-28 15:05:45 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:48096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Dec 28 15:05:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.238, lip=66.85.158.92, TLS, session=<iBqX1/9G/PjG6xju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:05:09 host2 sshd[3410539]: Disconnected from invalid user misp 137.184.30.179 port 59256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 28 15:06:32 host2 sshd[3411576]: Disconnected from invalid user hostinger 137.184.30.179 port 50354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 15:06:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+waM3f9GWqVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 15:08:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<kTEZ5f9GpMsuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.175
country_id: 3469034
description:
Dec 28 15:09:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=191.53.129.175, lip=66.85.158.91, TLS, session=<1L/55f9GnaO/NYGv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 28 15:09:47 host2 sshd[3414144]: Disconnected from invalid user db2fenc1 103.226.139.139 port 38260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.125
country_id: 3865483
description:
Dec 28 15:09:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=179.0.251.125, lip=66.85.158.91, TLS, session=<EGVO5/9G9uSzAPt9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 15:12:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ez7a8f9GypdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 15:12:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<iiRB8v9G+sMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 15:13:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IWHo8/9GAqSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.12.118.74
country_id: 3469034
description:
Dec 28 15:13:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.12.118.74, lip=66.85.158.91, TLS, session=<9pOV9P9GALexDHZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 28 15:14:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<faOt+f9GkpEDWgzA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 28 15:14:55 host2 pure-ftpd[3418771]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 15:15:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<b5XF/P9G3pYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 15:15:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3njd/P9GHMSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 15:18:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yJAECABHnA5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 15:18:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<sMrKCABHBNaElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 15:19:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<iLacCgBHiqEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 15:20:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GiGKDQBH2MIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 15:22:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<jHYnFQBH+KinrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 15:25:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SGncHwBHNLQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 15:28:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 14 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<2+C8KABHqMbBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 15:32:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<LIkqOABHnIunrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 15:32:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<eDm4OABHhLAv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.248.95
country_id: 2510769
description:
2025-12-28 15:32:43 dovecot_login authenticator failed for H=95.82-130-248.dynamic.clientes.euskaltel.es [82.130.248.95]:55602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 15:40:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<iv28VgBHFOsFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 15:42:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</stwXABH3GFo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 15:43:34 host2 pure-ftpd[3447850]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:43:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jdznYQBHfoYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 15:43:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DB/bYQBHNM0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 15:45:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<DeyiaABH6LWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 15:45:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<W3HuZwBHNIil6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.199.25
country_id: 6252001
description:
Dec 28 15:46:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.182.199.25, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Vbe0bABHXJKTtscZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.14
country_id: 2186224
description:
2025-12-28 15:47:35 dovecot_login authenticator failed for H=([121.73.163.14]) [121.73.163.14]:44656: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-28 15:48:02 dovecot_login authenticator failed for H=([201.166.222.48]) [201.166.222.48]:35397: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 15:48:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<T3/AcQBHhrCkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-28 15:49:16 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:48150: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.219
country_id: 1269750
description:
Dec 28 15:48:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.219, lip=66.85.158.91, TLS, session=<V3yNcQBHZ8JnpPbb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.8.13
country_id: 2300660
description:
Dec 28 15:48:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.8.13, lip=66.85.158.91, TLS, session=<56K7cgBHDcgpiwgN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-28 15:49:58 dovecot_login authenticator failed for H=([222.124.249.132]) [203.130.212.59]:52096: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 28 15:51:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<6zCDewBHaoAFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:51:04 host2 sshd[3454006]: Disconnected from invalid user dev 189.178.26.161 port 56532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:53:09 host2 sshd[3455501]: Disconnected from invalid user mani 189.178.26.161 port 33618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:53:18 host2 sshd[3455588]: Disconnected from invalid user es 154.83.15.200 port 43700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:52:30 host2 sshd[3454949]: Disconnected from invalid user debian 189.178.26.161 port 49314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 15:52:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<xoSogQBH/qMvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 15:54:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<GWdzhgBH8MOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 15:54:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gvyehgBH6zB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 15:53:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<SKMDhQBHRtgyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:54:36 host2 sshd[3456827]: Disconnected from invalid user forward 154.83.15.200 port 41204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Dec 28 15:55:48 host2 sshd[3457752]: Disconnected from invalid user newroot 154.83.15.200 port 38700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Dec 28 15:55:30 host2 sshd[3457595]: Disconnected from invalid user admin 189.178.26.161 port 55546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 15:58:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<g9g1lQBH7kYjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 28 15:59:17 host2 sshd[3460172]: Disconnected from invalid user monika 15.235.162.8 port 39860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 16:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<UYOVngBHtudnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 16:02:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<CcYDpQBHRNYuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 16:06:48 host2 sshd[3466336]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 16:08:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<my73uABHqLSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 16:09:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Fb2uvABHsKQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-28 16:09:38 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:53720: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-28 16:10:26 dovecot_login authenticator failed for H=([103.174.34.49]) [103.174.34.49]:54803: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 16:11:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Cv0YxgBH7qxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 16:12:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<kj4lyABHjoIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 16:12:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YkXxyABH0jhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 16:12:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<JOzpyABH5tynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 16:14:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<lqDB0ABHALAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 16:16:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<nN1A1gBHDrQzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 82.223.28.152 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 16:18:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</Aw93gBH0raElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 16:18:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<AHn83gBHaqOnrEV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2025-12-28 16:19:07 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:54200: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 16:19:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<OUMG4QBHWrRA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-28 16:20:33 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:48993: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 16:20:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GUob5gBHrMkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 28 16:20:57 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<pGnI5gBHoJMD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 28 16:22:49 host2 sshd[3479839]: Disconnected from invalid user alex 50.84.211.204 port 60162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 28 16:24:11 host2 sshd[3481153]: Disconnected from invalid user ts 50.84.211.204 port 32996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 16:27:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<y06t/ABHFp0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:30:23 host2 sshd[3486366]: Disconnected from invalid user spooler 192.3.105.24 port 48268 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:31:56 host2 sshd[3487413]: Received disconnect from 192.3.105.24 port 48394:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:32:13 host2 sshd[3487626]: Disconnected from invalid user deploy 43.166.245.172 port 17152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 28 16:31:52 host2 sshd[3487352]: Disconnected from invalid user amit 186.248.197.77 port 64084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 16:32:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bbj4EAFHmMmnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:33:02 host2 sshd[3488156]: Disconnected from invalid user marina 192.3.105.24 port 48472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 28 16:33:31 host2 sshd[3488425]: Disconnected from invalid user raaj 101.47.143.252 port 46818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:33:54 host2 sshd[3488708]: Disconnected from invalid user ftpuser 43.166.245.172 port 11776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 28 16:34:33 host2 sshd[3489444]: Disconnected from invalid user raaj 192.3.105.24 port 48600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Dec 28 16:35:43 host2 sshd[3490398]: Disconnected from invalid user cluster 101.47.143.252 port 41072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 16:36:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3zyfHgFHvNYFhXlo>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 28 16:36:53 host2 sshd[3491333]: Received disconnect from 43.166.245.172 port 17153:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 16:38:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<h7KmJQFH/uFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 16:38:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d9w6JgFHflEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 16:39:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cLxcKQFHzqUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 16:39:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<MghgKQFH/qml6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-28 16:40:40 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:39922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-28 16:41:22 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:44660: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 16:46:20 host2 pure-ftpd[3498895]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 16:48:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<j1g7SQFHSHmi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 16:50:34 host2 sshd[3502196]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 16:50:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<JEPrUQFH/Y9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.237
country_id: 953987
description:
Dec 28 16:50:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=102.129.54.237, lip=66.85.158.91, TLS, session=<EqXJUAFHuIBmgTbt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.61.202.27
country_id: 2510769
description:
Dec 28 16:50:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=5.61.202.27, lip=66.85.158.91, TLS, session=<N8GqTwFHPugFPcob>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-28 16:52:54 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:60944: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 16:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kydsWQFHuHIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 16:53:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Bow5WgFHOIcvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-28 16:53:18 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:49768: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 16:54:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<0lrmXQFHwoIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 28 16:55:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<dZ/gYAFHssQFhH+s>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.14.57.155
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.14.57.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.10.134.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.10.134.25 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.32.234
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.189.32.234 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 16:55:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9xmrYQFHXuNnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-28 16:56:12 dovecot_login authenticator failed for H=([122.185.152.72]) [122.187.222.54]:58516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.54.129.105
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.54.129.105 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.33.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 98.97.33.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.71.120.49
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 198.71.120.49 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.189.248
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.189.248 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.250.226.32
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.250.226.32 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.140.216.246
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.140.216.246 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-28 16:56:33 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:43282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 16:56:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<zkccZgFHrtsuZXpm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.242.132.82
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.242.132.82 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.75.126
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 100.0.75.126 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.37.57.77
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.37.57.77 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.237.22.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 167.237.22.137 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.40.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.105.40.17 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 16:59:27 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:47539: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 28 16:59:28 host2 sshd[3510027]: Disconnected from invalid user server 195.178.191.5 port 59336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 17:00:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<TCVVdAFHLsai8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 28 17:02:12 host2 sshd[3512539]: Disconnected from invalid user tempuser 195.178.191.5 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:01:54 host2 sshd[3512266]: Disconnected from invalid user abhi 185.121.0.2 port 56006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:02:32 host2 sshd[3512812]: Disconnected from invalid user user22 185.121.0.2 port 51346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:03:45 host2 sshd[3513934]: Disconnected from invalid user sajjad 185.121.0.2 port 36190 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:04:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hwi/gAFHxo0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 28 17:03:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FM/RfwFH/kBChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:04:20 host2 sshd[3514624]: Disconnected from invalid user esuser 185.121.0.2 port 36948 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:04:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ujd7ggFHRpkDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 28 17:05:31 host2 sshd[3515802]: Disconnected from invalid user student2 185.121.0.2 port 45186 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:05:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2TrBhgFHJLADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:06:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LcAviQFHKpcDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 17:06:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vkO+igFHEIUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 17:06:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YnDJigFHYhpniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:07:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<Esu3jgFH9t4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 17:08:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Sbk6kAFHMMlA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:08:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<7hpMkQFHnNsDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 17:09:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bIyulQFHtpwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 17:10:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yXtPlgFHTOEzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:09:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5E1FlAFHMI0DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-28 17:10:43 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:58586: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 28 17:10:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<idf3lwFHEIsDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-28 17:11:26 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:57899: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-28 17:11:59 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:37472: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 17:14:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<nIsrpQFHPJ6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 17:14:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+f61pAFH9pEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 17:14:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<KAftpQFH9MPJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 17:15:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<RUL4qAFHDO6nrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 17:15:34 host2 sshd[3524398]: Disconnected from invalid user ubnt 62.60.131.157 port 43725 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 17:16:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wQjUqwFHKp9A44h6>


