# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 10:29:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<6cZkGhBHCoKnrEV8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 10:30:24 host2 sshd[235774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 10:30:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<1BxJHxBHftwv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Dec 29 10:31:49 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS, session=<og8EJBBH9ovLN4MD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 10:33:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zAoJKxBH5Utniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 10:34:43 host2 sshd[239856]: Disconnected from invalid user  62.60.131.157 port 29144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 10:35:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<F/QEMBBHopZA44h6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 10:35:16 host2 pure-ftpd[240406]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-29 10:37:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49967: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 29 10:37:51 host2 sshd[242235]: Disconnected from invalid user administrator 103.153.190.105 port 39204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 10:38:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HD51PBBHvOOnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 10:38:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<tZezOhBHdIkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 10:39:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Tv1QPxBHVKAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 10:40:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<cUMIQxBHEsAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 10:44:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<mvbRTxBH2DNo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.57.28.95
country_id: 6252001
description:
Dec 29 10:45:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=13.57.28.95, lip=66.85.158.91, TLS: Connection closed, session=<utvuVRBH8rkNORxf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 10:48:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<5CHBXRBHcC9100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 10:49:04 host2 sshd[250951]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 10:50:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<snr/ZBBHcr5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 10:52:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8z+cbhBH3jgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 10:54:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Q976dBBH5JIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 10:54:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<KSHqdRBHnoWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 10:56:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<PfaXfRBH2rUvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 29 10:57:40 host2 sshd[258347]: Disconnected from invalid user ftpuser 103.153.190.105 port 46024 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.250.105.53
country_id: 6252001
description:
Dec 29 10:57:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=44.250.105.53, lip=66.85.158.92, TLS: Connection closed, session=<Wx8mgRBHuMYs+mk1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 11:00:45 host2 sshd[260701]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 11:02:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bQzjkRBH0JAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 11:02:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<6lXdkRBHTtml6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-29 11:02:50 dovecot_plain authenticator failed for H=(waddle) [199.192.123.12]:47864: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 11:03:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<UBdMlhBHrPei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 11:04:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<Gg0jmhBHqrGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 11:07:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<uiW1oRBHaOQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-12-29 11:09:04 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [179.185.18.67]:37802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-29 11:09:24 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:35836: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 11:09:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jxSiqRBH4rcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 29 11:10:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<5J4JrxBHwtjJvgxi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 29 11:10:57 host2 sshd[268810]: Disconnected from invalid user user 197.153.57.103 port 54212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.239
country_id: 3469034
description:
Dec 29 11:12:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.44.96.239, lip=66.85.158.91, TLS, session=<80/itRBHX8WxLGDv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.126.17
country_id: 6252001
description:
Dec 29 11:13:11 host2 sshd[270470]: Disconnected from invalid user ftptest 158.51.126.17 port 54372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.172
country_id: 3469034
description:
Dec 29 11:13:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=177.44.96.172, lip=66.85.158.91, TLS, session=<9v0TtxBHnOmxLGCs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 29 11:13:21 host2 sshd[270588]: Disconnected from invalid user oracle 197.153.57.103 port 53863 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 11:14:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<S6SAuxBHtOQv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 11:14:20 host2 sshd[271309]: Disconnected from invalid user  62.60.131.157 port 37112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 29 11:14:25 host2 sshd[271362]: Disconnected from invalid user es 197.153.57.103 port 39570 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.110.195.221
country_id: 6252001
description:
Dec 29 11:16:46 host2 pure-ftpd[273209]: (?@143.110.195.221) [INFO] New connection from 143.110.195.221


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Dec 29 11:18:46 host2 sshd[274465]: Disconnected from invalid user remoto 199.195.251.10 port 36012 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.197.237
country_id: 6252001
description:
Dec 29 11:18:54 host2 pure-ftpd[274571]: (?@165.227.197.237) [INFO] New connection from 165.227.197.237


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.24
country_id: 1269750
description:
Dec 29 11:19:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.109.178.24, lip=66.85.158.91, TLS, session=<wn7NzRBHkZ9nbbIY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.251.10
country_id: 6252001
description:
Dec 29 11:19:48 host2 sshd[275301]: Disconnected from invalid user alex 199.195.251.10 port 55274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.61
country_id: 3469034
description:
Dec 29 11:19:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=177.130.168.61, lip=66.85.158.91, TLS, session=<SBoczxBHT5qxgqg9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 11:20:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<84rG0RBHAsQyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-12-29 11:22:35 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:56420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-12-29 11:22:53 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:44198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Dec 29 11:23:39 host2 sshd[278153]: Disconnected from invalid user user5 199.195.251.10 port 41674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 11:23:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<umR13hBH8I6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 11:25:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3rj+5BBHPu2nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 11:26:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<JjOd6BBHGtIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 11:28:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<vh6w7xBHci5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 11:31:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<nRSP9xBHLu4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 11:33:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<bgEVAhFHtppA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 11:34:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OhZ4AhFHiE4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 29 11:34:16 host2 sshd[286060]: Disconnected from invalid user shoutcast 154.209.4.183 port 44564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.222.238
country_id: 3144096
description:
2025-12-29 11:35:47 dovecot_login authenticator failed for H=([178.232.222.238]) [178.232.222.238]:34802: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-29 11:36:05 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:36240: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 29 11:36:50 host2 sshd[288099]: Disconnected from invalid user bot1 198.98.57.141 port 48408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 29 11:37:46 host2 sshd[288688]: Disconnected from invalid user apps 198.98.57.141 port 59726 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 11:38:01 host2 pure-ftpd[288871]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 11:38:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<m25iERFHaKAuZXpm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 29 11:38:37 host2 sshd[289330]: Disconnected from invalid user john1 198.98.57.141 port 42808 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Dec 29 11:41:04 host2 sshd[291310]: Disconnected from invalid user vmail 101.36.107.103 port 42604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Dec 29 11:40:24 host2 sshd[290876]: Disconnected from invalid user john1 101.36.107.103 port 60762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 29 11:40:41 host2 sshd[291056]: Disconnected from invalid user user02 154.209.4.183 port 34272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.116
country_id: 3865483
description:
Dec 29 11:40:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=179.0.251.116, lip=66.85.158.91, TLS, session=<ukJrGRFHkqyzAPt0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.214
country_id: 3865483
description:
Dec 29 11:41:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=181.191.223.214, lip=66.85.158.91, TLS, session=<pM3kGhFHjbu1v9/W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 11:41:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zwoqHBFHsgV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 11:41:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<BFqpHBFHxGdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 29 11:41:28 host2 sshd[291565]: Disconnected from invalid user john1 154.209.4.183 port 56492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Dec 29 11:41:44 host2 sshd[291715]: Disconnected from invalid user kyle 101.36.107.103 port 40306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.209.4.183
country_id: 1819730
description:
Dec 29 11:42:16 host2 sshd[292105]: Disconnected from invalid user kyle 154.209.4.183 port 53020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.103
country_id: 3469034
description:
Dec 29 11:42:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=179.189.201.103, lip=66.85.158.91, TLS, session=<7h2kIBFHxd2zvcln>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 11:43:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cBqrJRFHboAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.186
country_id: 3865483
description:
Dec 29 11:43:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=179.0.250.186, lip=66.85.158.91, TLS, session=<7fDpIRFH+K6zAPq6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 11:43:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<E40VIxFHIoJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 11:46:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<eezzLRFH1M2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 11:47:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<L3mZMhFHwN5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.65
country_id: 3865483
description:
Dec 29 11:48:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=179.0.249.65, lip=66.85.158.91, TLS, session=<RJ1ZNBFHbMWzAPlB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.73
country_id: 3277605
description:
Dec 29 11:48:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=188.246.73.73, lip=66.85.158.91, TLS, session=<Sdu+NRFHBg+89klJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 11:48:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2jNuNxFHhjojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 11:48:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pxrRNxFHBOii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-29 11:53:40 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:60778: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 11:53:58 host2 sshd[302179]: Disconnected from invalid user oracle 62.60.131.157 port 7165 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.170
country_id: 3175395
description:
Dec 29 11:54:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.168.170, lip=66.85.158.91, TLS, session=</CNfShFHAtm5D6iq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.101
country_id: 3175395
description:
Dec 29 11:54:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.197.8.101, lip=66.85.158.91, TLS, session=<m7R4SxFH5Qu5xQhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-29 11:55:23 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:38516: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 11:59:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Uo4XXBFHkuel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 11:59:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<9DYQXhFH2qoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 12:01:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<sEg6ZBFHWqAvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.106.144
country_id: 1269750
description:
2025-12-29 12:03:35 dovecot_plain authenticator failed for H=(0SD7X7I) [103.59.106.144]:52345: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 12:03:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<vB5CbBFHGBmi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-29 12:04:12 dovecot_plain authenticator failed for H=(amethent) [65.20.250.163]:50140: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 12:07:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<68DSehFH2OUzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2025-12-29 12:08:49 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (noncifish) [73.188.252.208]:60688: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 12:10:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<pfo9gxFHypKElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-29 12:10:40 dovecot_plain authenticator failed for H=(comic) [92.62.243.174]:60299: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 12:10:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<n5o3hhFHbtYv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-29 12:14:06 dovecot_login authenticator failed for H=([75.170.21.223]) [75.170.21.223]:49166: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 12:14:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JeDekhFHeucv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-29 12:16:00 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:47108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-12-29 12:16:19 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:61992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-29 12:16:29 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:57388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 12:19:21 host2 sshd[324505]: Disconnected from invalid user moth3r 62.60.131.157 port 17946 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 29 12:20:48 host2 sshd[326087]: Disconnected from invalid user tempuser 59.98.148.5 port 51558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-29 12:21:16 dovecot_plain authenticator failed for H=(chism) [65.20.233.110]:37210: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 12:23:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<4mOEsxFHJMYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 12:23:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<XGF/sxFHYKqnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 29 12:23:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<5smAtBFHEKEFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 12:23:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jNbVtBFHPQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 12:26:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=</yMpvhFH9s4yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-29 12:28:04 dovecot_login authenticator failed for H=([59.99.153.21]) [59.99.153.21]:13933: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-29 12:28:33 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:50793: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 12:30:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<k+VOzBFHfpojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-29 12:31:58 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:47254: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 12:32:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<51G40RFHdNqnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.54
country_id: 1643084
description:
Dec 29 12:32:08 host2 sshd[335992]: Invalid user cloudtourssrilan_travel from 182.8.225.54 port 40976


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-29 12:31:37 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:56600: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-29 12:31:39 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:42038: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2025-12-29 12:31:54 dovecot_login authenticator failed for H=(OL16-114.fibertel.com.ar) [24.232.114.16]:47824: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.54
country_id: 1643084
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 182.8.225.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.218.158
country_id: 6252001
description:
Dec 29 12:32:43 host2 pure-ftpd[336577]: (?@165.154.218.158) [INFO] New connection from 165.154.218.158


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 12:33:30 host2 sshd[337322]: Disconnected from invalid user  62.60.131.157 port 7201 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 12:34:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<O4m52hFHeE5100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 12:35:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<jhDF3hFHOoAuZXpm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.218.158
country_id: 6252001
description:
Dec 29 12:36:04 host2 pure-ftpd[339954]: (?@165.154.218.158) [INFO] New connection from 165.154.218.158


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 12:36:39 host2 sshd[340360]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 165.154.218.158
country_id: 6252001
description:
Dec 29 12:36:23 host2 pure-ftpd[340171]: (?@165.154.218.158) [INFO] New connection from 165.154.218.158


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 12:36:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HPsS4RFHkKkv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.218.158
country_id: 6252001
description:
Dec 29 12:36:22 host2 pure-ftpd[340153]: (?@165.154.218.158) [INFO] New connection from 165.154.218.158


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 12:39:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<d8Hl7RFH3tVo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 12:40:33 host2 pure-ftpd[343774]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 12:42:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YoAC9hFHOpRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 12:43:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OweP+RFHMIei8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-29 12:43:33 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:55760: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.160.235
country_id: 2782113
description:
2025-12-29 12:43:43 dovecot_login authenticator failed for H=weissbrot.plingsi.net [152.53.160.235]:55630: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-29 12:43:56 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:44268: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-29 12:44:43 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:45722: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2025-12-29 12:45:46 dovecot_login authenticator failed for H=owniyj.static.otenet.gr [62.103.27.217]:62967: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 12:45:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<q0twARJHmkwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 12:45:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9W3tARJHurlnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 12:48:24 host2 sshd[350819]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 12:48:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7JOzDBJHaM8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 12:51:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<4fU+FxJHFrhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 12:54:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<qIUdIRJHOranrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 12:55:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<3c9UJhJHOKyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-29 12:56:51 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (cated) [73.213.237.28]:45506: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 12:58:48 host2 sshd[359364]: Disconnected from invalid user  62.60.131.157 port 49433 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 29 13:03:00 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, session=<xY6zQBJH/IlChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 13:03:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ePXWQhJHSIYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 13:04:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ymbcRBJHgP6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 13:05:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<xuBbSBJH0u0FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-29 13:05:49 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:49472: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-12-29 13:06:19 dovecot_login authenticator failed for H=([182.78.87.2]) [182.78.87.2]:45394: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 13:07:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<E1UfUhJHnswv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-29 13:08:53 dovecot_login authenticator failed for H=host-86-111-91-69.566f.la.net.ua [86.111.91.69]:58026: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-29 13:08:11 dovecot_plain authenticator failed for H=(paulmeed) [24.105.248.218]:51938: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-29 13:09:17 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:54195: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 13:12:50 host2 sshd[369777]: Disconnected from invalid user test 62.60.131.157 port 20676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 13:13:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<NLwWZhJHFokzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-29 13:13:35 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:49327: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-29 13:13:49 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:41298: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 13:15:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<Jg3SbhJHIOKElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 13:18:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</wFcdhJH9tgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 13:19:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dwu0fBJHPRlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 13:20:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<EkJpfRJHOLsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 29 13:20:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<f/idfxJHrrwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.20
country_id: 1512440
description:
2025-12-29 13:21:26 dovecot_login authenticator failed for H=([213.230.65.20]) [213.230.65.20]:42082: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-29 13:21:52 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:48544: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 13:22:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<0HCqhBJHON6nrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 29 13:23:37 host2 sshd[378019]: Disconnected from invalid user sammy 41.58.186.130 port 52922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 13:27:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<l2cimBJHLkQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 29 13:27:49 host2 sshd[381936]: Disconnected from invalid user ubuntu 41.58.186.130 port 50210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 13:28:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XFbcmhJHIEl100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 29 13:29:30 host2 sshd[383219]: Disconnected from invalid user admin 41.58.186.130 port 36326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.140
country_id: 3175395
description:
Dec 29 13:29:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.139.180.140, lip=66.85.158.91, TLS, session=<Lu0cnxJHbQ65i7SM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Dec 29 13:30:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<pSJKoBJH84yxgqgd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 13:30:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<NVwrohJHwNoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 13:33:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<EZQIrxJHZM0uZXpm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.58.186.130
country_id: 2328926
description:
Dec 29 13:35:08 host2 sshd[389393]: Disconnected from invalid user user1 41.58.186.130 port 37774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 13:36:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<41T+uRJHqs6i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-29 13:38:28 dovecot_login authenticator failed for H=(105-170-97-62.cust.smartcall.no) [62.97.170.105]:40272: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-29 13:38:38 dovecot_login authenticator failed for H=(187.161.198.68-clientes-izzi.mx) [187.161.198.68]:33685: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 13:39:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XEaGwRJHrIlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 13:40:37 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<vzgQxxJH3JCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 13:41:55 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vKO/yxJHxMYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 13:42:22 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<schczRJH2Mlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 13:42:30 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LvDWzRJHYDAjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 13:43:10 host2 pure-ftpd[396823]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-29 13:45:57 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:48616: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-29 13:46:10 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:36980: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2025-12-29 13:46:33 dovecot_login authenticator failed for H=(cm-178.232.221.122.get.no) [178.232.221.122]:44019: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2025-12-29 13:46:36 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:54667: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2025-12-29 13:48:35 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-29 13:50:01 dovecot_login authenticator failed for H=([200.148.171.233]) [189.56.0.19]:34638: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-29 13:50:18 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:42630: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 13:51:05 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<C8mB7BJHkpxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 13:52:42 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<BE5H8hJH/Lyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 13:53:33 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1gRY9RJHArAv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-29 13:54:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49354: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 14:00:30 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eqQvDhNH8rdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.173
country_id: 99237
description:
Dec 29 14:03:27 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=65.20.137.173, lip=66.85.158.91, TLS, session=<bczVFxNH3bJBFImt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 14:03:31 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Adz/GBNHjo6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 29 14:03:46 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<n7z5GBNHqqa7eEiI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-29 14:03:54 dovecot_login authenticator failed for H=([101.168.5.133]) [101.168.5.133]:53782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2025-12-29 14:04:17 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:33717: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 14:05:03 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<7i59HhNHKJii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 14:05:28 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<D6nvHxNH8NkvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.252
country_id: 6252001
description:
Dec 29 14:08:54 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.252, lip=66.85.158.91, TLS, session=<0NVgLBNHcvfG6xj8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2025-12-29 14:08:22 dovecot_login authenticator failed for H=(cm-178.232.218.47.get.no) [178.232.218.47]:37012: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-29 14:08:34 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:54704: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-29 14:08:48 dovecot_login authenticator failed for H=(cm-84.210.149.45.get.no) [84.210.149.45]:33923: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 14:09:30 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<BylbLhNHlOMFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:10:57 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8d61MxNHLtgDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:11:11 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lEaLNBNHipkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:13:14 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2A7hOxNHSK0DlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 14:13:54 host2 sshd[424026]: Disconnected from invalid user  62.60.131.157 port 36123 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:14:21 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<K7XUPxNHJsUDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-29 14:15:14 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:50924: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-29 14:15:32 dovecot_login authenticator failed for H=([128.185.247.254]) [125.19.158.2]:44182: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Dec 29 14:15:37 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.123, lip=66.85.158.92, TLS, session=<6TNkRBNHdvHG6xh7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 14:15:39 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xYhkRBNHCkNniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:17:11 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<6gX9SRNH4LcDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 14:19:01 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<lvFyUBNHXNenrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 14:19:44 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<z9H+UhNHDIkzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:19:50 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<H5V8UxNHuOUDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 14:20:01 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<I28AVBNHWseElEgp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:20:21 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+gBRVRNHDK4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 14:21:53 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ytGnWhNHfZN100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 29 14:22:41 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<VVWoXRNH7sQDlTsa>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 14:24:18 host2 sshd[433151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 14:24:21 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<hFiFYxNHQp0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 14:24:30 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qpcNZBNHbukjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 14:25:32 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4DXBZxNHcpsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 14:29:27 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<+26+dRNHssWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 29 14:30:48 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<SXyqehNHhuiLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 14:31:41 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<bhK7fRNH6qUuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 14:34:19 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Up0ZhxNHCpgyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 150.107.38.251
country_id: 1819730
description:
Dec 29 14:34:32 host2 dovecot[393332]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=150.107.38.251, lip=66.85.158.91, session=<f/YHiBNH7puWayb7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 29 14:34:52 host2 sshd[444316]: Disconnected from invalid user ali 52.183.128.237 port 40914 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 14:36:02 host2 sshd[445575]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 14:35:16 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<J3KLihNHppto7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 29 14:36:14 host2 sshd[445705]: Disconnected from invalid user elastic 43.245.97.82 port 58784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 29 14:36:17 host2 sshd[445740]: Disconnected from invalid user test 52.183.128.237 port 34840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 29 14:37:26 host2 sshd[446648]: Disconnected from invalid user frappe 52.183.128.237 port 60448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 29 14:39:06 host2 sshd[448001]: Disconnected from invalid user bitwarden 43.245.97.82 port 58504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 14:38:27 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<c2rXlRNHetVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.250.234
country_id: 1643084
description:
Dec 29 14:40:08 host2 sshd[448989]: Disconnected from invalid user devuser 222.124.250.234 port 34008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 14:39:25 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SZNdmRNH2IojupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.250.234
country_id: 1643084
description:
Dec 29 14:40:46 host2 sshd[449586]: Disconnected from invalid user bitwarden 222.124.250.234 port 59672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 222.124.250.234
country_id: 1643084
description:
Dec 29 14:41:22 host2 sshd[450111]: Disconnected from invalid user steam 222.124.250.234 port 33662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 29 14:41:32 host2 sshd[450249]: Disconnected from invalid user test 43.245.97.82 port 46994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.250.234
country_id: 1643084
description:
Dec 29 14:44:51 host2 sshd[453485]: Disconnected from invalid user oracle 222.124.250.234 port 59160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 222.124.250.234
country_id: 1643084
description:
Dec 29 14:45:26 host2 sshd[454207]: Disconnected from invalid user dennis 222.124.250.234 port 34522 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 14:45:53 host2 pure-ftpd[454628]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 14:47:46 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<w08+txNH/pAv/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 14:49:01 host2 sshd[457934]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 14:49:40 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Ui4CvhNHlpSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 14:52:09 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<FvbtxhNH8IGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 14:58:43 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Rl1q3hNHdJEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 15:00:53 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<LVoh5hNHurJA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-29 15:01:42 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:38101: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-29 15:01:15 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:44159: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 15:06:00 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<bZxr+BNHHGii8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 15:06:56 host2 sshd[476255]: Disconnected from invalid user  62.60.131.157 port 16816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 15:07:53 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<MHUx/xNH6sAvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 15:10:23 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+GEkCBRHMIFA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 15:11:50 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<le5GDRRHRCJniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-29 15:13:59 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com [203.198.173.137]:52252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-12-29 15:14:18 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:61818: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.250.216.79
country_id: 953987
description:
Dec 29 15:15:56 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=196.250.216.79, lip=66.85.158.91, TLS, session=<bwLvGhRHHc7E+thP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 15:16:10 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<MdrQHBRHvqinrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.105
country_id: 690791
description:
Dec 29 15:16:19 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<chitral00>, method=PLAIN, rip=37.221.134.105, lip=66.85.158.91, TLS, session=<1jsoHBRHXowl3YZp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 15:15:49 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<GyOUGxRHHsmnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 15:15:54 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PdPXGxRHKvl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.227
country_id: 3175395
description:
Dec 29 15:16:52 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.68.178.227, lip=66.85.158.91, TLS, session=<ysB4HhRH06y5RLLj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.93
country_id: 953987
description:
Dec 29 15:17:14 host2 dovecot[393332]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=102.129.63.93, lip=66.85.158.91, TLS, session=<bruXHxRHpZtmgT9d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 29 15:18:15 host2 sshd[488408]: Disconnected from invalid user myuser 62.219.172.50 port 49750 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 62.219.172.50
country_id: 294640
description:
Dec 29 15:20:23 host2 sshd[492053]: Received disconnect from 62.219.172.50 port 37842:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 29 15:20:23 host2 sshd[492053]: Disconnected from invalid user deniz 62.219.172.50 port 37842 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 15:21:02 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<Kmg4LhRH9NZV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Dec 29 15:20:54 host2 sshd[492800]: Disconnected from invalid user user 62.219.172.50 port 44034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-29 15:22:18 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:37558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 15:21:48 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HkbtMBRHCt8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 15:22:14 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<nU2DMhRHZuKi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.145.233
country_id: 1605651
description:
2025-12-29 15:23:30 dovecot_login authenticator failed for H=([110.49.145.233]) [110.49.145.233]:48140: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-29 15:22:56 dovecot_login authenticator failed for H=([172.191.74.151]) [172.191.74.151]:34982: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 29 15:23:55 host2 sshd[496017]: Disconnected from invalid user steam 62.219.172.50 port 60178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-29 15:24:18 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:53108: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-12-29 15:24:50 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:53406: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 15:24:59 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<+P9UPBRHQqiElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 15:26:46 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<XI+vQhRHytAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-29 15:30:27 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:60430: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2025-12-29 15:29:51 dovecot_login authenticator failed for H=([167.250.118.12]) [167.250.118.12]:39365: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 15:29:59 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<J9I+ThRHdpAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 15:31:23 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<M+I0UxRHJMIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 15:31:46 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<9PWbVBRH3A1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 15:32:01 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Ba96VRRHIqwv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.78
country_id: 6252001
description:
Dec 29 15:33:22 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.78, lip=66.85.158.92, session=</lV2WhRHyJAUQGhO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 15:34:27 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sjMsXhRHNLZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 15:36:44 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2fBRZhRHOC4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 29 15:37:22 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=</l2faBRHgtrJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 15:39:15 host2 dovecot[393332]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<a6hJbxRHwsMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.252
country_id: 6252001
description:
Dec 29 15:44:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.252, lip=66.85.158.91, session=<6LqPghRHPM0UQGn8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-29 15:45:17 dovecot_login authenticator failed for H=(aes-static-041.100.144.59.airtel.in) [182.95.57.158]:53804: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-29 15:45:55 dovecot_login authenticator failed for H=200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:35735: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 15:45:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nh9uhxRH8Oil6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.81.132.188
country_id: 6252001
description:
Dec 29 15:46:02 host2 pure-ftpd[518537]: (?@172.81.132.188) [INFO] New connection from 172.81.132.188


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 15:48:43 host2 pure-ftpd[521000]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 29 15:52:11 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.11, lip=66.85.158.92, session=<PA69nRRHWrBV2YwL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 15:53:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hriboxRHOrwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-29 15:53:58 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:49472: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-29 15:54:16 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:56056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-29 15:54:35 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:45960: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-29 15:55:26 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:45124: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-29 15:55:14 dovecot_login authenticator failed for H=(scz-181-188-149-00243.tigo.bo) [181.188.149.243]:51637: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.50
country_id: 2635167
description:
Dec 29 16:01:37 host2 dovecot[512723]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.50, lip=66.85.158.92, TLS, session=<HuFzvxRHTaBX7LAy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 16:04:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<hD8xyRRH6OAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 16:04:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<58gVyhRHIKunrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-29 16:04:55 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:56336: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-29 16:05:07 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:55876: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-29 16:06:19 dovecot_login authenticator failed for H=(cm-84.210.192.240.get.no) [84.210.192.240]:37140: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 16:06:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<iCjp0BRHhL6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-29 16:06:40 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:39336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-29 16:07:03 dovecot_login authenticator failed for H=c80-216-181-233.bredband.tele2.se [80.216.181.233]:41348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.186
country_id: 3144096
description:
2025-12-29 16:07:43 dovecot_login authenticator failed for H=(186-161-97-62.cust.smartcall.no) [62.97.161.186]:47048: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 16:07:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<1tVO1RRH1AVniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-29 16:08:10 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:59452: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 16:11:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ACD54BRHoKcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 16:11:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<NHUF4RRHgjZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 16:10:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jK1a4BRHQJ5A44h6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 16:12:13 host2 sshd[544836]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 16:13:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<+jiR6hRH9J+nrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.26.115.111
country_id: 6252001
description:
Dec 29 16:14:15 host2 sshd[546781]: Invalid user cloudtourssrilan_travel from 193.26.115.111 port 51459


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 16:14:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<2f8g7hRH0tKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 16:14:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<p79x7hRH0OlV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-29 16:16:31 dovecot_plain authenticator failed for H=(motee) [65.20.133.208]:48200: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-29 16:17:23 dovecot_login authenticator failed for H=([128.185.246.106]) [128.185.246.106]:51580: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-29 16:17:46 dovecot_login authenticator failed for H=([103.147.248.23]) [103.147.248.23]:49936: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 16:17:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<QMUU+RRHAoYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 16:18:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VGPw+RRHzIYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 16:20:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ZEvVARVH6JpA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 29 16:22:42 host2 sshd[554458]: Disconnected from invalid user admin1 181.188.172.6 port 39780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 29 16:23:30 host2 sshd[555274]: Disconnected from invalid user infra 181.188.172.6 port 52082 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 16:23:59 host2 sshd[555752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 16:24:34 host2 sshd[556789]: Disconnected from invalid user  62.60.131.157 port 42719 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 16:27:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<7I9TGhVHqsMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 16:28:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<At0sHhVHaJKnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 16:28:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<7tMRIBVHhvdo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 16:28:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<WrUSIRVH+plnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 16:30:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<2KSSJhVHXomElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 16:32:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OePDLRVHvNojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 16:32:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<j6F0LxVHXtEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 16:37:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7+uOPxVHBNUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 16:37:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<e4a1PxVHpIUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 16:41:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<XH6aThVHoKel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 16:44:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<f3o8WRVHSo4yBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.201.208
country_id: 6251999
description:
Dec 29 16:46:36 host2 pure-ftpd[578840]: (?@128.203.201.208) [INFO] New connection from 128.203.201.208


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.201.208
country_id: 6251999
description:
Dec 29 16:46:46 host2 pure-ftpd[578989]: (?@128.203.201.208) [INFO] New connection from 128.203.201.208


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 16:49:12 host2 sshd[582054]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-29 16:48:53 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:47092: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-29 16:49:06 dovecot_login authenticator failed for H=(pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:45548: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 16:51:31 host2 pure-ftpd[584526]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-29 16:54:30 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:50440: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.244.238
country_id: 2077456
description:
2025-12-29 16:54:41 dovecot_login authenticator failed for H=([161.8.244.238]) [161.8.244.238]:52600: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.58.125
country_id: 2921044
description:
Dec 29 16:56:10 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.58.125, lip=66.85.158.92, session=<tlSVghVHZo12wTp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.58.125
country_id: 2921044
description:
Dec 29 16:57:18 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.58.125, lip=66.85.158.91, session=<K7qdhhVHdrt2wTp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 16:59:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Ep+3jhVHBq8v/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 17:01:47 host2 sshd[594200]: Disconnected from invalid user ubnt 62.60.131.157 port 35001 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 17:04:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HrWXoRVHxjBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 17:06:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<qGmxqBVHOI6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 17:07:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<cHRnqRVHLrSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 17:07:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nHCMqRVH8/l100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 17:08:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<xcj4rhVHZpJV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 29 17:09:39 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1KrJshVHiv8t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 17:10:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<oRExtRVHArynrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 17:10:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<TVKftRVHGsMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.66
country_id: 2963597
description:
Dec 29 17:11:16 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=37.203.49.66, lip=66.85.158.91, TLS, session=<wiyStxVHHZglyzFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.191
country_id: 3175395
description:
Dec 29 17:11:34 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.124.182.191, lip=66.85.158.91, TLS, session=<CjOkuBVHq625fLa/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 17:15:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<kbG9xhVHjJEvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-29 17:17:37 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65151: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 17:17:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZoRb0BVHCL+nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 17:18:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<wONw0hVHBJ4FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 17:19:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<x8Jn1RVHfKNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 17:23:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<b5No5BVHMLpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 17:24:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PRrf5hVH+oouZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.133.2
country_id: 6252001
description:
2025-12-29 17:24:52 dovecot_plain authenticator failed for H=syn-024-097-133-002.biz.spectrum.com (dishae) [24.97.133.2]:57564: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-29 17:25:24 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:56528: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 17:25:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<waex6xVHUM9o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-29 17:25:13 dovecot_login authenticator failed for H=([182.95.24.117]) [182.95.56.134]:49226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 17:28:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Fjip9BVHNNwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 17:28:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<T1FW9RVH4rdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.153.174.23
country_id: 298795
description:
Dec 29 17:29:15 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=213.153.174.23, lip=66.85.158.91, TLS, session=<A1+79xVHboXVma4X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.108
country_id: 3865483
description:
Dec 29 17:29:38 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=179.0.250.108, lip=66.85.158.91, TLS, session=</CsG+RVHNb2zAPps>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-29 17:29:59 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:53426: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-29 17:30:36 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:48171: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-29 17:35:31 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:35228: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-29 17:35:57 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:60335: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 17:36:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<CmWkERZHpNiElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 17:37:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<IIoVFRZHqNozTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 17:38:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GTgHGRZHMM+l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-29 17:39:36 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (ordic) [68.82.141.145]:38542: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-29 17:40:10 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:58732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-29 17:40:23 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:44458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 17:41:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xp4sIxZHoLIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 17:41:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<phJ4JBZHHpMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 17:42:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<38maJxZHSumnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-29 17:44:09 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (fluough) [73.129.57.71]:47632: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.145.213
country_id: 2921044
description:
Dec 29 17:43:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.145.213, lip=66.85.158.92, session=<Dm00KxZHkx4uZZHV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Dec 29 17:43:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.248.36, lip=66.85.158.92, session=<A24+KxZHjBguZfgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 29 17:51:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<toNERhZHZs4FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 17:51:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<1KaeSBZHJroyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-29 17:52:15 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br [187.126.105.42]:59374: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.14
country_id: 2186224
description:
2025-12-29 17:52:29 dovecot_login authenticator failed for H=([121.73.163.14]) [121.73.163.14]:51994: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 17:54:36 host2 pure-ftpd[641667]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 17:56:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XpYKWhZHdRBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 17:59:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<fInbYxZHdNai8GQy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 18:00:23 host2 sshd[645817]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 18:00:41 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<IdkVaRZH4wN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 18:02:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<NUgLbhZHxpsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 18:02:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<PeD6cBZHgOhV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 18:03:25 host2 sshd[648339]: Disconnected from invalid user admin 62.60.131.157 port 17916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 18:04:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<0LJqeBZHyDSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 18:09:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bJ2NiBZH/JgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 18:09:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<aBQ5iRZHksOnrEV8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 18:12:08 host2 sshd[655372]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-29 18:14:29 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:46474: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.29.239.66
country_id: 1880251
description:
2025-12-29 18:15:05 dovecot_login authenticator failed for H=([114.29.239.66]) [114.29.239.66]:42722: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 18:17:10 host2 sshd[659601]: Disconnected from invalid user admin 62.60.131.157 port 40798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 18:18:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<g62YpxZH/Kgv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 18:18:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KkXAqBZHzLJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 18:20:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<2PeSrhZHyKcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 18:21:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<3Uo/shZH1sUuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 18:20:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<hIBcsRZHSOwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 18:24:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qJOtvBZHHKkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 18:25:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</wiNwBZH1k1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-29 18:25:30 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (nally) [217.215.74.195]:38697: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:25:33 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ECw8whZHkJkDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2025-12-29 18:25:36 dovecot_login authenticator failed for H=([81.8.218.251]) [81.8.218.251]:34616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 18:25:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<PkbowhZH2qFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2025-12-29 18:26:00 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:60089: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:26:19 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BRfwxBZH2o0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.74
country_id: 1819730
description:
Dec 29 18:26:34 host2 sshd[667282]: Disconnected from invalid user user 118.193.39.74 port 59408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Dec 29 18:28:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.14, lip=66.85.158.91, session=<96xKzBZHyL5V2YwO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-29 18:28:27 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:45030: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-29 18:28:44 dovecot_login authenticator failed for H=14-0-142-131.static.pccw-hkt.com [14.0.142.131]:11005: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.132.162.227
country_id: 2921044
description:
Dec 29 18:29:05 host2 sshd[669732]: Disconnected from invalid user user 91.132.162.227 port 42560 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:29:53 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<h4i90RZHetIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Dec 29 18:29:16 host2 sshd[669834]: Disconnected from invalid user user1 185.174.182.226 port 43710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.174.182.226
country_id: 2510769
description:
Dec 29 18:30:26 host2 sshd[670881]: Disconnected from invalid user alex 185.174.182.226 port 40214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.132.162.227
country_id: 2921044
description:
Dec 29 18:30:41 host2 sshd[671182]: Disconnected from invalid user es 91.132.162.227 port 59710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:30:49 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<d4gJ1RZHctIDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2025-12-29 18:32:06 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:57230: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:31:18 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<I2jA1hZHIrMDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Dec 29 18:33:09 host2 sshd[673164]: Disconnected from invalid user es 190.181.27.27 port 60032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 29 18:33:10 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<h3173RZHXogDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-29 18:32:24 dovecot_login authenticator failed for H=h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:41078: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.90.41.136
country_id: 1522867
description:
2025-12-29 18:32:24 dovecot_login authenticator failed for H=178.90.41.136.dynamic.telecom.kz [178.90.41.136]:35366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 91.132.162.227
country_id: 2921044
description:
Dec 29 18:33:13 host2 sshd[673212]: Received disconnect from 91.132.162.227 port 39044:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 18:33:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<czE/3hZHzsSnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.132.162.227
country_id: 2921044
description:
Dec 29 18:33:42 host2 sshd[673674]: Disconnected from invalid user user1 91.132.162.227 port 59394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.174.182.226
country_id: 2510769
description:
Dec 29 18:33:51 host2 sshd[673808]: Disconnected from invalid user ftptest 185.174.182.226 port 51926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.14.179.134
country_id: 3469034
description:
Dec 29 18:34:37 host2 sshd[674580]: Disconnected from invalid user user 143.14.179.134 port 41804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 18:34:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ckn44hZH2uZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 18:35:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<jd4z5BZHwtel6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.74
country_id: 1819730
description:
Dec 29 18:35:33 host2 sshd[675790]: Disconnected from invalid user es 118.193.39.74 port 36022 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.14.179.134
country_id: 3469034
description:
Dec 29 18:36:44 host2 sshd[676708]: Disconnected from invalid user ftptest 143.14.179.134 port 49568 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 29 18:38:07 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<5AAN7hZH0evJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.232
country_id: 3865483
description:
Dec 29 18:38:28 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.252.232, lip=66.85.158.91, TLS, session=<m49L7xZHuIuzAPzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 18:39:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+Lc29RZHltgzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Dec 29 18:40:18 host2 sshd[679887]: Disconnected from invalid user jenkins 179.33.210.213 port 40046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.210.213
country_id: 3686110
description:
Dec 29 18:41:42 host2 sshd[680900]: Disconnected from invalid user db12c 179.33.210.213 port 39256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2025-12-29 18:41:43 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:43732: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 18:42:06 host2 sshd[681264]: Disconnected from invalid user  62.60.131.157 port 28119 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.74
country_id: 1819730
description:
Dec 29 18:42:38 host2 sshd[681566]: Disconnected from invalid user user5 118.193.39.74 port 52528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.98.154.184
country_id: 290557
description:
2025-12-29 18:42:23 dovecot_login authenticator failed for H=bba-86-98-154-184.alshamil.net.ae [86.98.154.184]:56390: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 18:43:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<XK/6ARdHxLmElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 18:43:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iMPJAxdHIIsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 18:44:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ZxXNBBdHJrEzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.252.219
country_id: 2635167
description:
Dec 29 18:44:25 host2 pure-ftpd[683091]: (?@165.154.252.219) [INFO] New connection from 165.154.252.219


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 18:52:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UI92IRdH/rCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 18:54:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<9mX0KRdHeNV100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 18:56:01 host2 sshd[695533]: Disconnected from invalid user  62.60.131.157 port 34623 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2025-12-29 18:56:05 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:48788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.18
country_id: 2186224
description:
2025-12-29 18:56:25 dovecot_login authenticator failed for H=([121.73.163.18]) [121.73.163.18]:33160: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 29 18:56:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<CNLpMBdHiNsFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 18:58:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<uC7BNhdHhMOnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 18:57:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<+Y+2NBdHiotV6odu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 18:58:12 host2 pure-ftpd[697716]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 18:58:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<X7yENxdHfLAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 19:02:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<km4xRhdHKiii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 19:05:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OFgwTxdHHt4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 19:05:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<v7WfUBdH3NgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.16
country_id: 3175395
description:
Dec 29 19:07:50 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.170.16, lip=66.85.158.91, TLS, session=<qHNvWBdHDo25D6oQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-29 19:07:17 dovecot_login authenticator failed for H=([125.23.178.65]) [182.78.64.18]:52714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.13
country_id: 933860
description:
Dec 29 19:08:14 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=41.216.213.13, lip=66.85.158.91, TLS, session=<MpmfWRdHt7Mp2NUN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-29 19:08:25 dovecot_plain authenticator failed for H=(shidaphyu) [65.20.143.159]:59945: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 19:09:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<My6xXxdHGLOnrEV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.47.54.175
country_id: 3895114
description:
2025-12-29 19:10:53 dovecot_login authenticator failed for H=pc-175-54-47-190.cm.vtr.net [190.47.54.175]:40458: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-12-29 19:10:40 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:34516: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 19:14:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CFXJbxdH1Jxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 19:17:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Hv4rfBdHiIcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 19:20:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EqcchRdHMOMjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 19:20:44 host2 sshd[717104]: Disconnected from invalid user  62.60.131.157 port 49391 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-29 19:21:09 dovecot_login authenticator failed for H=([103.109.13.50]) [103.109.13.50]:56304: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2025-12-29 19:22:01 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:34546: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 19:22:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7WhCjRdH9IkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 19:24:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<rqIklBdHktUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-29 19:24:19 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (rigerval) [24.91.103.202]:50434: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 19:24:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KeDVkxdHnipo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 19:26:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<pXisnRdHpowv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 29 19:31:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=149.28.49.123, lip=66.85.158.92, TLS: Connection closed, session=<cLPwrhdHBLWVHDF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 19:32:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<C77OsRdHPqel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 19:32:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<N5jpsRdHDt9A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-29 19:34:23 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:58597: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-29 19:34:46 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:44488: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 19:35:18 host2 sshd[728819]: Disconnected from invalid user admin 62.60.131.157 port 48197 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Dec 29 19:35:59 host2 sshd[729621]: Disconnected from invalid user sajid 206.42.14.196 port 51214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.173
country_id: 2635167
description:
Dec 29 19:38:04 host2 sshd[731478]: Disconnected from invalid user zgr 185.196.10.173 port 60166 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 29 19:38:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<YILExRdH9f8t4/6Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.173
country_id: 2635167
description:
Dec 29 19:38:22 host2 sshd[731672]: Disconnected from invalid user secure 185.196.10.173 port 53398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.173
country_id: 2635167
description:
Dec 29 19:38:59 host2 sshd[732076]: Disconnected from invalid user mini 185.196.10.173 port 41428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.173
country_id: 2635167
description:
Dec 29 19:39:17 host2 sshd[732489]: Disconnected from invalid user tim 185.196.10.173 port 33258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 29 19:39:34 host2 sshd[732784]: Disconnected from invalid user admin 41.216.178.119 port 59826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.145.144
country_id: 3932488
description:
Dec 29 19:40:24 host2 sshd[733872]: Disconnected from invalid user library 38.19.145.144 port 16226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.145.144
country_id: 3932488
description:
Dec 29 19:41:39 host2 sshd[735326]: Disconnected from invalid user nexus 38.19.145.144 port 28236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 19:41:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<CxGM0hdHQNpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-12-29 19:42:56 dovecot_login authenticator failed for H=([121.73.163.22]) [121.73.163.22]:38780: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 19:42:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<5mD51hdHqsEzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.145.144
country_id: 3932488
description:
Dec 29 19:42:16 host2 sshd[736086]: Disconnected from invalid user zgr 38.19.145.144 port 48987 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Dec 29 19:42:40 host2 sshd[736313]: Disconnected from invalid user vncuser 206.42.14.196 port 53888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2025-12-29 19:43:56 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:46860: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.42.14.196
country_id: 3469034
description:
Dec 29 19:43:56 host2 sshd[737177]: Disconnected from invalid user nexus 206.42.14.196 port 56000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.145.144
country_id: 3932488
description:
Dec 29 19:44:07 host2 sshd[737325]: Disconnected from invalid user yuan 38.19.145.144 port 10496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Dec 29 19:43:19 host2 sshd[736791]: Disconnected from invalid user library 206.42.14.196 port 47248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 29 19:44:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YGHu2xdHF//CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 19:45:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<FEpv3xdHmJii8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 29 19:46:08 host2 sshd[739486]: Disconnected from invalid user openwrt 41.216.178.119 port 36346 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 19:47:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<0Yxf5RdHQLIv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-12-29 19:46:45 dovecot_login authenticator failed for H=([197.156.97.198]) [197.156.97.198]:58168: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 19:47:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<0+u35hdHo0Jniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-29 19:47:12 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:43769: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 19:47:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<m2Is5hdHzo4zTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 19:49:24 host2 sshd[742046]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 29 19:49:26 host2 sshd[742035]: Disconnected from invalid user test 41.216.178.119 port 34034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 19:49:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<sb1K7hdHzMSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 19:49:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QQeD7hdH4Jl100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 29 19:50:16 host2 sshd[743170]: Disconnected from invalid user testuser 41.216.178.119 port 59078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2025-12-29 19:51:17 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:36452: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 19:51:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<jeil9BdH8JqElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-29 19:51:31 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:34125: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 19:53:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<W+HN/BdH/sFV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 20:00:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<A/o3FRhHFECi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-29 20:00:59 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:53012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-29 20:01:18 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:54306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 20:01:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<bL98GRhHttsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 20:01:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<doZHGhhH6C4jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 20:02:27 host2 pure-ftpd[754617]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 29 20:05:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<dr92JhhHiqjJvgxi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-29 20:06:31 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:33275: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-29 20:06:55 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:53378: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.164
country_id: 2186224
description:
2025-12-29 20:07:00 dovecot_login authenticator failed for H=([121.73.163.164]) [121.73.163.164]:45038: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 20:07:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UkeRLhhHerwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 20:10:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<VSp0OBhH3K+nrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 20:14:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<MQwaRxhHdq0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 20:14:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<DchFRxhHkManrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 29 20:15:33 host2 sshd[766080]: Disconnected from invalid user yupei 155.4.244.169 port 54077 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 20:16:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pqMwThhH5j0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 29 20:17:38 host2 sshd[767542]: Disconnected from invalid user deployment 155.4.244.169 port 65421 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.53.236.155
country_id: 1168579
description:
Dec 29 20:19:07 host2 sshd[768989]: Disconnected from invalid user administrator 101.53.236.155 port 30813 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 29 20:18:21 host2 sshd[768084]: Disconnected from invalid user zhao 155.4.244.169 port 16207 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Dec 29 20:18:46 host2 sshd[768571]: Disconnected from invalid user maman 186.233.118.22 port 45756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Dec 29 20:19:27 host2 sshd[769437]: Disconnected from invalid user judith 186.233.118.22 port 53480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 29 20:19:36 host2 sshd[769601]: Disconnected from invalid user teste 43.129.41.91 port 51082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 20:21:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<QoifYRhHHBVo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.53.236.155
country_id: 1168579
description:
Dec 29 20:22:27 host2 sshd[771787]: Disconnected from invalid user admin2 101.53.236.155 port 62971 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 29 20:23:27 host2 sshd[772485]: Disconnected from invalid user marketing 43.129.41.91 port 41684 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 20:24:51 host2 sshd[773616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 29 20:24:15 host2 sshd[773151]: Disconnected from invalid user user2 43.129.41.91 port 57480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-29 20:25:39 dovecot_plain authenticator failed for H=ool-457e901e.dyn.optonline.net (zodely) [69.126.144.30]:56989: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 29 20:25:57 host2 sshd[774892]: Disconnected from invalid user omar 43.129.41.91 port 48092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 20:26:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<vEngcBhHvrovWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 20:29:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0JKmfRhHTpal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 20:30:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<QTNPfxhHIOIFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.131.134
country_id: 3865483
description:
Dec 29 20:32:33 host2 sshd[780174]: Disconnected from invalid user dst 186.122.131.134 port 45018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.131.134
country_id: 3865483
description:
Dec 29 20:33:26 host2 sshd[780777]: Disconnected from invalid user transfer 186.122.131.134 port 58222 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.122.131.134
country_id: 3865483
description:
Dec 29 20:34:11 host2 sshd[781278]: Disconnected from invalid user sabine 186.122.131.134 port 41154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.131.134
country_id: 3865483
description:
Dec 29 20:35:33 host2 sshd[782675]: Disconnected from invalid user ldap 186.122.131.134 port 35686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 20:36:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ietylhhHHNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 20:37:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<2QdwmxhHPJSi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-29 20:38:48 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64556: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-29 20:38:30 dovecot_plain authenticator failed for H=host-95-229-5-248.business.telecomitalia.it (sychy) [95.229.5.248]:48660: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 20:38:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<twStnRhHEpVA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 20:40:06 host2 sshd[786281]: Disconnected from invalid user admin 62.60.131.157 port 13822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.61.22
country_id: 3144096
description:
2025-12-29 20:40:35 dovecot_login authenticator failed for H=(cm-178.232.61.22.get.no) [178.232.61.22]:60972: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-29 20:40:55 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:54200: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 20:41:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tDG6qRhHkSdniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 29 20:41:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS handshaking: Connection closed, session=<O/VvqRhHalFChJmM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 20:43:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<r4cNsRhHiJd100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-29 20:44:15 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:48362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 20:44:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<a2x2shhHVNAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.164.159
country_id: 3144096
description:
2025-12-29 20:44:28 dovecot_login authenticator failed for H=([62.97.164.159]) [62.97.164.159]:55204: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 20:47:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<MO9BvRhH1tRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 20:48:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1QPlvxhHirgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 20:48:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8iJowRhHjIUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 20:49:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<p63jxBhHOIhV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 20:54:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<M7VV2BhHYpZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 20:56:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UKIF3xhHYn8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 20:58:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ADSz5BhHkLOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 20:59:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<2ODq5xhHauqElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-29 21:02:54 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:41874: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.78
country_id: 1269750
description:
2025-12-29 21:03:15 dovecot_login authenticator failed for H=([27.123.104.78]) [27.123.104.78]:36058: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 21:03:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5ywc+BhHhooyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 21:05:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<M/A5/xhHSq6nrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 21:06:37 host2 pure-ftpd[809041]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.45
country_id: 6252001
description:
Dec 29 21:07:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.45, lip=66.85.158.91, session=<c2kPBRlHJWpAPpwt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Dec 29 21:07:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.38, lip=66.85.158.91, TLS: Connection closed, session=<i22pBRlHYrFAPpwm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 21:08:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<KW3CCBlHaKUv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-29 21:08:38 dovecot_login authenticator failed for H=([183.171.53.82]) [183.171.53.82]:48286: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 21:09:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<sPrMDBlHwqinrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 21:11:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZlrzERlHYlIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 21:11:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<qQHhERlHZNcuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-29 21:15:51 dovecot_plain authenticator failed for H=(venhae) [81.181.129.131]:48230: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.166.196
country_id: 3469034
description:
Dec 29 21:17:49 host2 sshd[819443]: Disconnected from invalid user postgres 177.0.166.196 port 60599 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 21:18:38 host2 sshd[819983]: Disconnected from invalid user  62.60.131.157 port 43071 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 29 21:18:41 host2 sshd[820025]: Disconnected from invalid user assistant 144.31.195.14 port 53846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.167.52
country_id: 1643084
description:
Dec 29 21:19:08 host2 sshd[820371]: Disconnected from invalid user mohit 180.243.167.52 port 46720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 21:19:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<JHJRLxlH7NVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-29 21:19:34 dovecot_plain authenticator failed for H=(rakardod) [81.181.129.131]:40225: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.167.52
country_id: 1643084
description:
Dec 29 21:20:05 host2 sshd[821738]: Disconnected from invalid user jorgodubare 180.243.167.52 port 34554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.243.167.52
country_id: 1643084
description:
Dec 29 21:20:52 host2 sshd[822646]: Disconnected from invalid user user 180.243.167.52 port 39792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 29 21:20:35 host2 sshd[822442]: Disconnected from invalid user ubuntu 42.200.66.164 port 38428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.167.52
country_id: 1643084
description:
Dec 29 21:21:39 host2 sshd[823298]: Disconnected from invalid user chris 180.243.167.52 port 46414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 29 21:22:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5a1TOhlHbsQjy9Ka>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.243.167.52
country_id: 1643084
description:
Dec 29 21:22:28 host2 sshd[823956]: Disconnected from invalid user dmdba 180.243.167.52 port 35886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 29 21:22:29 host2 sshd[824003]: Disconnected from invalid user exploit 152.32.238.146 port 53374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 29 21:24:02 host2 sshd[825470]: Disconnected from invalid user vncuser 42.200.66.164 port 49408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Dec 29 21:24:04 host2 sshd[825473]: Disconnected from invalid user monitor 202.79.29.108 port 39364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.166.196
country_id: 3469034
description:
Dec 29 21:24:54 host2 sshd[826255]: Disconnected from invalid user server 177.0.166.196 port 57782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.158.247.76
country_id: 6252001
description:
Dec 29 21:24:34 host2 sshd[826025]: Disconnected from invalid user kafka 94.158.247.76 port 35028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.158.247.76
country_id: 6252001
description:
Dec 29 21:25:40 host2 sshd[827128]: Disconnected from invalid user media 94.158.247.76 port 49994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 29 21:25:59 host2 sshd[827361]: Disconnected from invalid user thiago 42.200.66.164 port 33402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 29 21:26:03 host2 sshd[827456]: Disconnected from invalid user minecraft 152.32.238.146 port 50306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 21:26:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<DtBDShlHTpSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 21:26:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<fpNZShlHYJ4vWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Dec 29 21:27:39 host2 sshd[828664]: Disconnected from invalid user exit 202.79.29.108 port 47158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 29 21:28:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS, session=<hlCwThlHXOcjy9Ka>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 29 21:27:24 host2 sshd[828521]: Disconnected from invalid user hk 129.226.150.85 port 47860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-29 21:29:54 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:42256: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-29 21:29:13 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:55622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 29 21:29:33 host2 sshd[830123]: Disconnected from invalid user nominatim 129.226.150.85 port 41560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 29 21:30:19 host2 sshd[831082]: Disconnected from invalid user admin 129.226.150.85 port 52684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 21:30:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<s+m0VxlHxpyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 21:30:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HFkkWBlHMoanrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 21:33:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<2BZOYRlHGL8FhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.237
country_id: 2635167
description:
Dec 29 21:36:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.237, lip=66.85.158.91, TLS handshaking: Connection closed, session=<t501bRlHicO594nt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.249
country_id: 2635167
description:
Dec 29 21:37:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.249, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IhwxbxlHq+m594n5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.94
country_id: 2635167
description:
Dec 29 21:36:30 host2 dovecot[512723]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.94, lip=66.85.158.91, TLS, session=<AqwTbRlHz4K594le>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.244
country_id: 2635167
description:
Dec 29 21:37:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.244, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<02YscRlHF+y594n0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 21:38:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<naWgdRlHP19100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.225
country_id: 2635167
description:
Dec 29 21:38:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.225, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<uucncxlHZ4xX7LDh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 21:38:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZuVsdBlHHgpniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.218
country_id: 2635167
description:
Dec 29 21:38:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.218, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<EiQjdRlHYZ2594na>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.239
country_id: 2635167
description:
Dec 29 21:39:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.239, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cJocdxlHq+dX7LDv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.243
country_id: 2635167
description:
Dec 29 21:39:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.243, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<fOgZeRlHl5ZX7LDz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.236
country_id: 2635167
description:
Dec 29 21:40:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.236, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<FlsVexlH3aa594ns>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.239
country_id: 2635167
description:
Dec 29 21:40:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.239, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Q7IOfRlH0ce594nv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.235
country_id: 2635167
description:
Dec 29 21:41:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.235, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<3RYKfxlHyZy594nr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 21:44:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<a0KIiBlH7LVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 21:44:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<WiV1ihlH3pszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 21:45:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<pte+ixlHWJdV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 21:46:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<c2k+kBlHcLwv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2025-12-29 21:47:51 dovecot_plain authenticator failed for H=(nomacki) [94.254.244.211]:42447: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 21:48:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<NbB1mRlHzOEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 21:48:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<P5ZdmRlH2J0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 21:51:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<e7sQoxlH5qwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 21:53:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<8k9qqBlHuI9A44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 29 21:53:18 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K9AqqRlH5jpAPsWn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.3.193
country_id: 1269750
description:
2025-12-29 21:55:28 dovecot_plain authenticator failed for H=(JKJEX) [152.59.3.193]:61539: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 21:56:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<m19PsxlHwE6i8Jp9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.214
country_id: 6252001
description:
Dec 29 21:56:19 host2 pure-ftpd[865360]: (?@205.210.31.214) [INFO] New connection from 205.210.31.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-29 21:58:52 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rapre) [87.103.126.54]:26999: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-29 22:02:06 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4390: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 22:03:01 host2 sshd[870134]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2025-12-29 22:02:50 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:54091: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-29 22:03:03 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:44307: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-29 22:03:06 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:48217: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 22:05:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cKFq1RlHpOieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 22:05:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4HxE1hlH1nojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 22:05:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qely1BlHALVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 22:06:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<dIwX2BlHpIQyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 22:07:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<pt8p3RlHKJIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 22:07:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<59RH3RlH+suElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 22:09:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Lnmc4RlH6ImnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 22:09:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kEpV4hlH/pgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 22:10:36 host2 sshd[876646]: Disconnected from invalid user  62.60.131.157 port 47807 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 22:10:22 host2 pure-ftpd[876509]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-29 22:11:32 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:57928: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.224
country_id: 6252001
description:
Dec 29 22:14:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.224, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Jle38xlHl8BBMQHg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 22:14:57 host2 sshd[880683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 29 22:14:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5k/F9BlHYhlBMQHe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-29 22:14:52 dovecot_plain authenticator failed for H=(preoccusly) [81.181.129.131]:18517: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 22:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<P9LjARpHwoFo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-29 22:22:25 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:57732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-29 22:22:36 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:42577: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.142
country_id: 798544
description:
Dec 29 22:22:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.28.142, lip=66.85.158.91, TLS, session=<Fe3OERpH/+ay2ByO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 22:23:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<L11HExpHELOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 22:23:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KteIExpHQtinrKy4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.172.172.184
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.172.172.184] [Remote Port]=[55362] [Authentication Database]=[mail] [Username]=[postfix@venee.lk] (10/10 failures) (blocked until [Tue Dec 30 16:53:02 2025 UTC/Tue Dec 30 22:23:02 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 22:23:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<WkUqFBpHCKui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.73
country_id: 3469034
description:
Dec 29 22:23:32 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng>, method=PLAIN, rip=177.44.71.73, lip=66.85.158.91, TLS, session=<KM7nExpHAMixLEdJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-29 22:24:16 dovecot_plain authenticator failed for H=(stwines) [102.53.15.18]:57849: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 22:24:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<NvOuGBpHON6l6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.168.242
country_id: 6252001
description:
Dec 29 22:25:47 host2 pure-ftpd[893427]: (?@54.174.168.242) [INFO] New connection from 54.174.168.242


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.106
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.106: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 22:28:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<w58OJhpHzIIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.238.127.92
country_id: 3573591
description:
2025-12-29 22:28:48 dovecot_plain authenticator failed for H=(L7V1JJ7) [201.238.127.92]:65215: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.36.178
country_id: 3351879
description:
2025-12-29 22:29:27 dovecot_plain authenticator failed for H=(10I184C09IJ1) [102.214.36.178]:54648: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 22:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nQkeLxpHHTJniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-12-29 22:32:03 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:56926: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.175.61.93
country_id: 3469034
description:
2025-12-29 22:31:40 dovecot_login authenticator failed for H=(189-44-229-57.customer.tdatabrasil.net.br) [179.175.61.93]:42128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-29 22:31:58 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:53860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 22:34:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ELSNOxpH8vZ100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 22:34:50 host2 sshd[900894]: Disconnected from invalid user  62.60.131.157 port 61116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 22:37:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<TySTRRpHvOYFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 29 22:37:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GKI0RxpHuMlKUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2025-12-29 22:38:56 dovecot_login authenticator failed for H=([121.73.169.111]) [121.73.169.111]:49080: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-29 22:39:22 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:45032: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.99.252.8
country_id: 6251999
description:
Dec 29 22:40:16 host2 sshd[905806]: Disconnected from invalid user postgres 192.99.252.8 port 59784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 22:41:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=</tFBVBpHVthV6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:41:15 host2 sshd[906649]: Disconnected from invalid user testuser 45.61.187.220 port 50732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:41:38 host2 sshd[906940]: Disconnected from invalid user admin 160.174.129.232 port 40400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 29 22:42:11 host2 sshd[907473]: Disconnected from invalid user k8s 206.189.36.162 port 45246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.94.69.183
country_id: 2661886
description:
2025-12-29 22:42:25 dovecot_plain authenticator failed for H=183-69.soderhamn.com (bonfaces) [81.94.69.183]:50672: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 29 22:42:52 host2 sshd[908189]: Disconnected from invalid user administrador 206.189.36.162 port 57208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.105
country_id: 798544
description:
Dec 29 22:43:40 host2 sshd[908841]: Disconnected from invalid user ionadmin 83.168.78.105 port 54884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:44:08 host2 sshd[909245]: Disconnected from invalid user user 103.174.114.50 port 36212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:43:09 host2 sshd[908466]: Disconnected from invalid user test 45.61.187.220 port 55954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.105
country_id: 798544
description:
Dec 29 22:44:53 host2 sshd[909924]: Disconnected from invalid user test 83.168.78.105 port 41260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 29 22:44:27 host2 sshd[909479]: Disconnected from invalid user bitrix 85.206.171.113 port 32976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:45:32 host2 sshd[910764]: Disconnected from invalid user bitrix 45.61.187.220 port 44086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 22:46:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<DfsUZhpH4IAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 29 22:46:16 host2 sshd[912138]: Disconnected from invalid user webserver 209.141.33.240 port 47512 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[32992] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Dec 30 17:16:07 2025 UTC/Tue Dec 30 22:46:07 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 22:46:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0h5oaBpHVKgjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[43092] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (12/10 failures) (blocked until [Tue Dec 30 17:16:46 2025 UTC/Tue Dec 30 22:46:46 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 29 22:46:57 host2 sshd[912797]: Disconnected from invalid user test 155.248.164.42 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:47:15 host2 sshd[913124]: Disconnected from invalid user socksuser 160.174.129.232 port 42871 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:47:41 host2 sshd[913529]: Disconnected from invalid user rd 103.174.114.50 port 58140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 112.120.170.82
country_id: 1819730
description:
Dec 29 22:47:28 host2 sshd[913366]: Disconnected from invalid user user 112.120.170.82 port 43468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 29 22:48:09 host2 sshd[914167]: Disconnected from invalid user testuser 155.248.164.42 port 47858 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:48:18 host2 sshd[914303]: Received disconnect from 160.174.129.232 port 54652:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 22:48:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<iAbibxpHDoWnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.207.88
country_id: 1880251
description:
Dec 29 22:49:56 host2 sshd[915957]: Disconnected from invalid user test 152.42.207.88 port 41236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 22:50:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q9DVcxpHFMkv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[51476] [Authentication Database]=[mail] [Username]=[webmaster@lankaherbalsolutions.com] (11/10 failures) (blocked until [Tue Dec 30 17:19:58 2025 UTC/Tue Dec 30 22:49:58 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.207.88
country_id: 1880251
description:
Dec 29 22:50:40 host2 sshd[916812]: Disconnected from invalid user alex 152.42.207.88 port 43238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:50:55 host2 sshd[916964]: Disconnected from invalid user jerry 103.174.114.50 port 57398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 22:50:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Sc5ldRpHpoUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 22:50:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<KYsqdhpHeptA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 22:54:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<IzizgxpH7FKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.7.13
country_id: 1269750
description:
2025-12-29 22:55:42 dovecot_plain authenticator failed for H=(L7V1JJ7) [152.56.7.13]:59831: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-29 22:56:42 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:51626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-29 22:56:54 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:36212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 22:57:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VH9BkBpHuJwv+wDY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.136.122
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.136.122] [Remote Port]=[52484] [Authentication Database]=[mail] [Username]=[no-reply@dataesite.lk] (11/10 failures) (blocked until [Tue Dec 30 17:29:36 2025 UTC/Tue Dec 30 22:59:36 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 22:59:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YRRElhpHBM1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.211.130.180
country_id: 6252001
description:
2025-12-29 22:59:42 dovecot_login authenticator failed for H=([162.211.130.180]) [162.211.130.180]:45808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:00:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<q4TymhpHvOaeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec 29 23:01:59 host2 pure-ftpd[927371]: (?@172.105.128.11) [INFO] New connection from 172.105.128.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:01:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<KocrnBpHXmYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:04:37 host2 sshd[930240]: Disconnected from invalid user user 103.83.87.46 port 46744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 23:05:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<DBMGrBpHAMQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.141
country_id: 3144096
description:
2025-12-29 23:05:52 dovecot_login authenticator failed for H=(cm-178.232.162.141.get.no) [178.232.162.141]:37216: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-29 23:05:30 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:43857: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:07:30 host2 sshd[933076]: Disconnected from invalid user postgresql 103.83.87.46 port 44348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 23:09:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<rxKcuBpHFsoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 23:09:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<A2/LuhpHuJGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 23:10:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZRmivBpHSokv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 23:10:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ux86vhpH4t9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:11:54 host2 sshd[936872]: Disconnected from invalid user user 103.83.87.46 port 44400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:12:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Ryr4xRpHP8Ki2JY6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 23:13:32 host2 pure-ftpd[938137]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:13:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zR41yRpHcO6i2JY6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 23:15:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<s24r0BpHEKWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 23:16:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<+sGj0RpHgK2ElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2025-12-29 23:18:56 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:3259: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:18:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<pPgu2RpHqMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 23:18:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<e8rV2RpHZqpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 29 23:19:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<e7ty3BpHOLvE+2YO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.224.110
country_id: 2077456
description:
2025-12-29 23:19:15 dovecot_login authenticator failed for H=(203-221-224-110.tpgi.com.au) [203.221.224.110]:38886: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 29 23:20:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mQEh4hpHzsGYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:21:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS, session=<U4IU5RpHEuWi2JY6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 23:22:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<d/dk6RpHxOel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 23:23:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4Kp/6hpHnxFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:24:30 host2 sshd[946847]: Disconnected from invalid user contador 148.216.49.99 port 45858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:28:07 host2 sshd[949667]: Disconnected from invalid user db2admin 148.216.49.99 port 54416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:28:47 host2 sshd[950033]: Disconnected from invalid user willie 148.216.49.99 port 42084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 23:29:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<mExYARtHRJp100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-29 23:29:42 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:10329: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-29 23:29:42 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:36570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 23:29:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tgvtARtHltUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-29 23:29:56 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:51354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:29:26 host2 sshd[950436]: Disconnected from invalid user pieter 148.216.49.99 port 46650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.51.185
country_id: 3144096
description:
2025-12-29 23:29:41 dovecot_login authenticator failed for H=(cm-84.215.51.185.get.no) [84.215.51.185]:48046: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-29 23:29:41 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:52695: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2025-12-29 23:30:11 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:50294: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-29 23:30:28 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:34572: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 23:36:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<ZURtGhtHKrJV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 23:39:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<RUEHJRtHLuEFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.220
country_id: 6252001
description:
Dec 29 23:40:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.220, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nEcMKRtHnXlAPpzc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 29 23:40:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3bsXKhtHXghAPpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 29 23:41:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS: Connection closed, session=<S97oKhtHeFZAPpzU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 23:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<T+tGLhtHQMSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:42:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OJFjLxtHnMMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.221.180.165
country_id: 6252001
description:
Dec 29 23:44:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.221.180.165, lip=66.85.158.91, session=<9RGEOBtHIsUS3bSl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.221.180.165
country_id: 6252001
description:
Dec 29 23:44:57 host2 pure-ftpd[963341]: (?@18.221.180.165) [INFO] New connection from 18.221.180.165


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 23:47:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gClnQhtHspAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-29 23:48:43 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:56229: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 23:50:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DR0/TRtHhpcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 23:52:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gIOlURtHbKozTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 23:52:11 host2 sshd[969734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 23:53:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<5JZoVhtHwLGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:56:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<V8boYBtHJKyeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:56:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rBQgYxtHQF8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 23:57:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</WnYYxtHbrNA44h6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2025-12-29 23:59:13 +0530] info [cpaneld] 85.215.116.20 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.42
country_id: 6252001
description:
Dec 29 23:59:40 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.42, lip=66.85.158.91, TLS, session=<vikZbRtHUvyTuYQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-29 23:59:53 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (codip) [73.53.254.168]:53130: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 00:00:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63968: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 00:02:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<EQcqdxtHoOwv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 00:03:57 host2 sshd[980868]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 30 00:03:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1uP3ehtHeqMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 00:05:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OuphgBtHhrFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 00:06:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<BHs2hBtH2oRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 00:07:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<jbejihtHtKGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 00:08:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<s08PjBtHpJ2i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 72.14.178.148
country_id: 6252001
description:
Dec 30 00:10:00 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=72.14.178.148, lip=66.85.158.92, session=<1gwKkhtHXMFIDrKU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 00:11:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<QFIBlhtHBrIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 00:11:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<AyuJmBtHzLEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 00:13:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<J8qGnhtHgOCeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-12-30 00:15:12 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:60236: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-30 00:15:47 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:35128: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 00:15:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<81y4phtHOxtniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 00:15:59 host2 pure-ftpd[992214]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 00:18:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GPzcrhtHovBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:18:37 host2 sshd[994440]: Disconnected from invalid user nicolas 115.187.45.27 port 42170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:19:29 host2 sshd[995107]: Disconnected from invalid user auditor 115.187.45.27 port 49465 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:20:15 host2 sshd[995910]: Disconnected from invalid user law 115.187.45.27 port 56466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 30 00:20:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fSN9uBtHFLWl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:21:38 host2 sshd[997141]: Disconnected from invalid user ftpadmin 115.187.45.27 port 42233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-30 00:22:10 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:44254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-30 00:22:23 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:40565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 00:24:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fThSxRtH4ZN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 00:24:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<wBDbxRtH+I6ElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 00:24:58 host2 sshd[1000038]: Disconnected from invalid user  62.60.131.157 port 45075 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-30 00:28:53 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:52379: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Dec 30 00:29:02 host2 dovecot[512723]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS, session=<Svge1htHItnLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-30 00:29:41 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:43742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-30 00:29:16 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:46246: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 00:31:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2M/Y3RtHIrovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-30 00:31:21 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:51082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 00:31:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<gNcQ3xtHmOaYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-30 00:31:34 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:50382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 00:31:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<YrvW3xtHFotV6odu>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.223
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.223: 250 connections per 30 seconds to 2080 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.223
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.223: 408 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 00:37:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qznj9RtH+kMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-30 00:39:45 dovecot_plain authenticator failed for H=(hiridan) [91.73.188.251]:43686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.252
country_id: 6252001
description:
Dec 30 00:42:05 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.252, lip=66.85.158.91, TLS, session=<C5TOBBxHLPKTuYT8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 00:41:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<tF2gAxxHtJEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 00:44:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1QshDhxHtKBCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 00:47:52 host2 sshd[1023484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 00:49:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gYRsIBxHtrEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 00:51:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Ik5UJhxHGoSeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.81
country_id: 6252001
description:
Dec 30 00:51:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rXPGJxxH9d3N0h9R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 00:52:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<vCkeKBxHcu6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 00:52:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GMVpKBxHtLEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 00:52:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<S6a9KRxHMMcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 00:52:41 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wlSWKhxHPM4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 00:54:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yt7OLxxHduszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 00:59:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<f6dIQRxH/tZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 01:00:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<z3zmRhxH6tGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 30 01:01:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<63vJSBxH9OUuZXpm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:01:18 host2 sshd[1036850]: Disconnected from invalid user admin 62.60.131.157 port 64285 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 01:02:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<eh8gTRxH3IunrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.155
country_id: 6252001
description:
Dec 30 01:02:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.237.125.155, lip=66.85.158.92, session=<KuccTxxHvIaH7X2b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 01:04:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<9PM5VBxHduRA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.33
country_id: 6252001
description:
Dec 30 01:07:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.33, lip=66.85.158.91, session=<wpsEYRxHsJIUQcAh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 01:08:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tfmnYhxHyUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 01:08:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<AKEGZBxHLN+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 01:12:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<EJeIchxHupcv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2025-12-30 01:13:07 dovecot_login authenticator failed for H=([75.183.106.192]) [75.183.106.192]:45876: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 01:13:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<VfgIdRxHqpZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:14:10 host2 sshd[1048862]: Disconnected from invalid user admin 62.60.131.157 port 12859 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 01:14:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<8d5VehxHzKoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.69.194
country_id: 6252001
description:
Dec 30 01:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.56.69.194, lip=66.85.158.92, session=<dUi6hRxH0LYtOEXC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 01:17:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XkHUhBxHVt9o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.229.239
country_id: 6252001
description:
Dec 30 01:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.255.229.239, lip=66.85.158.92, session=<6zi+hRxHgs+t/+Xv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 01:18:28 host2 pure-ftpd[1053023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 01:18:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<0rNIhxxHpIp100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2025-12-30 01:20:43 +0530] info [webmaild] 82.223.28.152 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.66
country_id: 6252001
description:
Dec 30 01:21:46 host2 pure-ftpd[1056555]: (?@205.210.31.66) [INFO] New connection from 205.210.31.66


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.217
country_id: 2921044
description:
Dec 30 01:22:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.74.217, lip=66.85.158.92, TLS, session=<U+zPlhxHHDKl6ErZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 01:27:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<RlHNpxxHZJZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 01:29:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<j6+CrBxH4omnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.205.225
country_id: 6252001
description:
Dec 30 01:29:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=69.164.205.225, lip=66.85.158.92, session=<J0HJrxxH+sRFpM3h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 01:31:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<P98TtRxHRqcFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 01:33:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<iyAAuxxHlp8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 01:33:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pxCFvRxHQlgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 01:34:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<dru2vxxHbt6ElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:37:27 host2 sshd[1072331]: Disconnected from invalid user  62.60.131.157 port 61915 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.80.53.81
country_id: 1168579
description:
2025-12-30 01:38:24 dovecot_plain authenticator failed for H=([192.168.56.1]) [154.80.53.81]:54826: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 01:39:46 host2 sshd[1074699]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 01:43:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1MLc3xxH6K8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 01:43:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<dS5n4RxH/s2YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 01:44:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kQg24xxHjtVCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.169
country_id: 6252001
description:
Dec 30 01:44:26 host2 pure-ftpd[1079018]: (?@91.230.168.169) [INFO] New connection from 91.230.168.169


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.173
country_id: 6252001
description:
Dec 30 01:44:25 host2 pure-ftpd[1079016]: (?@91.230.168.173) [INFO] New connection from 91.230.168.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 01:45:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<1HEo5hxH4NUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 01:46:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jK7x6xxHMNGeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-30 01:47:27 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (ferestr) [67.173.58.47]:52334: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 01:48:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jG6X8RxHPs4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 01:48:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<8CmP8hxHTLSi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:50:20 host2 sshd[1084247]: Disconnected from invalid user  62.60.131.157 port 61619 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 01:51:27 host2 sshd[1085177]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 01:52:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</t29/hxHyL0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 01:52:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cI2n/xxHnK1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 01:53:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<i9c8BB1HfpOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 01:53:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<To6FBR1HzMov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 01:56:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<1vIPDh1HgLUzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 02:00:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hytin) [87.103.126.54]:47404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 02:00:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<A0uHHR1Hsh9niu0S>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[45756] [Authentication Database]=[mail] [Username]=[info@anandaobauae.org] (10/10 failures) (blocked until [Tue Dec 30 20:33:57 2025 UTC/Wed Dec 31 02:03:57 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:03:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<mDuJKR1HvLKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 30 02:04:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<ap/WKx1H4JqLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.158.232
country_id: 6252001
description:
Dec 30 02:05:41 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.158.232, lip=66.85.158.91, session=<vwbGLx1HgMKsaZ7o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.167.88
country_id: 6252001
description:
Dec 30 02:05:41 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.167.88, lip=66.85.158.91, session=<IHvLLx1HpOfOvadY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-30 02:07:49 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:43943: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-30 02:08:01 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:14818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.165
country_id: 1643084
description:
Dec 30 02:07:39 host2 sshd[1100928]: Disconnected from invalid user test 103.187.147.165 port 48978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.45
country_id: 6252001
description:
Dec 30 02:08:51 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6D8VOx1HdNXG6xgt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-30 02:12:40 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.69.49
country_id: 6252001
description:
Dec 30 02:13:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=45.56.69.49, lip=66.85.158.91, session=<1xzsSR1H1pItOEUx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 02:13:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<6cjFSh1Hgqd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 02:14:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<utA1Tx1HtJUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 02:17:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kDNlWx1H/vpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 02:18:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<LK18XR1HaKsyBsPO>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.9.129
country_id: 3469034
description:
[2025-12-30 02:19:40 +0530] info [cpaneld] 207.248.9.129 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 02:20:53 host2 pure-ftpd[1113519]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-30 02:21:14 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (colable) [71.62.34.216]:51206: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-30 02:23:12 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:58558: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 02:23:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Rz4tbh1HVqKnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-30 02:23:40 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:33056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Dec 30 02:23:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oSbmcB1H4sqTuYQx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 02:24:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<tImach1HKNRV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 30 02:27:41 host2 sshd[1118842]: Disconnected from invalid user customer 179.33.186.151 port 55136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:28:03 host2 sshd[1119295]: Disconnected from invalid user portal 186.80.18.158 port 42644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 30 02:28:20 host2 sshd[1119529]: Disconnected from invalid user bryan 179.33.186.151 port 34363 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:28:39 host2 sshd[1119780]: Disconnected from invalid user sftptest 186.80.18.158 port 41318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:29:15 host2 sshd[1120251]: Disconnected from invalid user production 186.80.18.158 port 37112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 02:29:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<W92phR1HKCsjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.136.36
country_id: 6252001
description:
Dec 30 02:32:16 host2 sshd[1122641]: Disconnected from invalid user backupuser 206.217.136.36 port 34538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 30 02:32:33 host2 sshd[1122842]: Disconnected from invalid user panel 103.182.132.154 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Dec 30 02:32:39 host2 sshd[1122924]: Disconnected from invalid user sdtdserver 164.92.236.103 port 33642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 30 02:33:52 host2 sshd[1124279]: Disconnected from invalid user deploy 152.32.191.75 port 50788 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.105.235.55 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Dec 30 02:33:21 host2 sshd[1123718]: Disconnected from invalid user ares 206.217.136.36 port 40260 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.157.20
country_id: 1819730
description:
Dec 30 02:33:46 host2 sshd[1124155]: Disconnected from invalid user client 150.5.157.20 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.89.95
country_id: 6252001
description:
Dec 30 02:34:38 host2 sshd[1124983]: Disconnected from invalid user simone 144.172.89.95 port 51388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 02:34:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cF+Klx1HpJAv+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.172.89.95
country_id: 6252001
description:
Dec 30 02:35:41 host2 sshd[1126235]: Disconnected from invalid user mongouser 144.172.89.95 port 35210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 02:35:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<wct9mx1HfIYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 02:37:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<b4qWoR1HVo4FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<X2QLsh1HBJOeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.186.9
country_id: 6252001
description:
Dec 30 02:42:19 host2 sshd[1132106]: Disconnected from invalid user max 157.245.186.9 port 33122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:42:34 host2 sshd[1132288]: Disconnected from invalid user ec2-user 27.254.137.144 port 42388 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:43:44 host2 sshd[1133123]: Disconnected from invalid user bk 27.254.137.144 port 53522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 02:44:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oxMpuh1HCpMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 02:44:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GJ2guh1H4oRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.3
country_id: 3469034
description:
Dec 30 02:44:33 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=200.77.179.3, lip=66.85.158.91, TLS, session=<R6y3uR1Ht8LITbMD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:44:50 host2 sshd[1134062]: Disconnected from invalid user william 27.254.137.144 port 38418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.114.89.9
country_id: 798544
description:
Dec 30 02:44:55 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=188.114.89.9, lip=66.85.158.91, TLS, session=<tATfuh1HfoC8clkJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec 30 02:44:19 host2 sshd[1133659]: Disconnected from invalid user sysadmin 205.185.127.60 port 34130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-30 02:45:18 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:48638: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:45:25 host2 sshd[1135017]: Disconnected from invalid user test 27.254.137.144 port 60004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-30 02:45:32 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:49383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 02:45:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<o3Aovh1H4MBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 02:46:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<E2McwB1HRAqi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.127.60
country_id: 6252001
description:
Dec 30 02:46:14 host2 sshd[1136116]: Disconnected from invalid user robot 205.185.127.60 port 39982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 02:46:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<8j7rwR1HAMCElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:47:00 host2 sshd[1136750]: Disconnected from invalid user android 103.215.80.173 port 54376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 02:46:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<v7kMwx1HJJ6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Dec 30 02:47:37 host2 sshd[1137386]: Disconnected from invalid user odoo15 190.128.241.2 port 26057 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 02:48:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<iXtGyR1HXI+nrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.213
country_id: 1643084
description:
Dec 30 02:49:01 host2 sshd[1138563]: Disconnected from invalid user omer 103.59.95.213 port 38562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 02:49:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Dc+BzB1HnuQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Dec 30 02:49:39 host2 sshd[1139279]: Disconnected from invalid user username 190.128.241.2 port 57210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:51:23 host2 sshd[1141107]: Disconnected from invalid user steam 103.215.80.173 port 56256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:52:12 host2 sshd[1141584]: Disconnected from invalid user bk 101.47.51.7 port 44726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 02:53:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2z5l2R1HkARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 02:54:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<9Oam3R1HvsAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:55:42 host2 sshd[1145007]: Disconnected from invalid user odoo15 101.47.51.7 port 59998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 02:55:45 host2 sshd[1145039]: Disconnected from invalid user test 117.247.23.131 port 60190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 02:55:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SBHX4h1HoKMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:55:48 host2 sshd[1145204]: Disconnected from invalid user testuser 103.215.80.173 port 38082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:56:50 host2 sshd[1145993]: Disconnected from invalid user pacific 101.47.51.7 port 50226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 02:57:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<D6Wu6R1HMqWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 02:58:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<hY4r7R1HapMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:59:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<//qK8B1HgIyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2025-12-30 02:59:45 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:38552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 02:59:49 host2 sshd[1148632]: Received disconnect from 82.115.13.156 port 36412:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 02:59:49 host2 sshd[1148632]: Disconnected from invalid user ubuntu 82.115.13.156 port 36412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.109.101
country_id: 3144096
description:
2025-12-30 02:59:57 dovecot_login authenticator failed for H=(cm-178.232.109.101.get.no) [178.232.109.101]:49889: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 03:00:45 host2 sshd[1149828]: Disconnected from invalid user ftpadmin 82.115.13.156 port 55754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-30 03:07:10 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:33876: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2025-12-30 03:07:23 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:57682: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 03:07:29 host2 sshd[1155954]: Disconnected from invalid user ubuntu 117.247.23.131 port 51664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 03:08:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BAxYEB5HEAV100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 30 03:10:03 host2 sshd[1157899]: Disconnected from invalid user admin 45.78.223.11 port 47162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-30 03:14:26 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:43235: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-30 03:14:39 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:54220: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.188.0.71
country_id: 3996063
description:
Dec 30 03:15:44 host2 sshd[1163690]: Disconnected from invalid user pepper 187.188.0.71 port 53336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 03:16:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ArJaLR5HoMQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.188.0.71
country_id: 3996063
description:
Dec 30 03:16:50 host2 sshd[1164871]: Disconnected from invalid user bass 187.188.0.71 port 37480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-30 03:17:56 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:41554: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-30 03:18:11 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:51202: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 03:19:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WkAOOB5Httlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-30 03:20:38 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (augeness) [24.23.125.83]:43494: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 03:20:52 host2 sshd[1167957]: Disconnected from invalid user ubuntu 117.247.23.131 port 44728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 03:22:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<m7BuQR5HCqRV6odu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 03:22:56 host2 pure-ftpd[1169221]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 03:23:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<pZtURB5HhrsyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 30 03:24:19 host2 sshd[1170334]: Disconnected from invalid user test 138.204.127.54 port 48362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:25:08 host2 sshd[1171274]: Disconnected from invalid user test 95.128.196.243 port 36296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:25:12 host2 sshd[1171360]: Disconnected from invalid user admin 198.1.117.220 port 56528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 03:25:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2AQ4Th5HnFojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2025-12-30 03:27:02 dovecot_login authenticator failed for H=([77.74.34.30]) [91.149.142.17]:35078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:26:51 host2 sshd[1172559]: Disconnected from invalid user userftp 198.1.117.220 port 34992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 30 03:26:13 host2 sshd[1172108]: Disconnected from invalid user test 138.204.127.54 port 40252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 03:26:46 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63361: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 03:26:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<er4fUh5HlN4v+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 03:27:29 host2 sshd[1173096]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:27:56 host2 sshd[1173395]: Disconnected from invalid user user 198.1.117.220 port 58278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-30 03:28:05 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53348: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-30 03:27:34 dovecot_login authenticator failed for H=([186.97.203.163]) [186.97.203.163]:38558: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:27:56 host2 sshd[1173395]: Received disconnect from 198.1.117.220 port 58278:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 30 03:29:03 host2 pure-ftpd[1174838]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:29:16 host2 sshd[1174954]: Disconnected from invalid user ubuntu1 95.128.196.243 port 45798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.207
country_id: 6252001
description:
Dec 30 03:29:46 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.207, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uhN6XB5HQq4s3LnP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.243.168
country_id: 1269750
description:
Dec 30 03:33:05 host2 sshd[1177796]: Disconnected from invalid user test 49.207.243.168 port 53886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.243.168
country_id: 1269750
description:
Dec 30 03:34:18 host2 sshd[1178760]: Disconnected from invalid user username 49.207.243.168 port 54396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.49
country_id: 6252001
description:
Dec 30 03:35:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.49, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tksRch5HFNLN0h8x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:36:54 host2 sshd[1181095]: Disconnected from invalid user git 95.128.196.243 port 56104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 03:37:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sdU9eR5HyN6eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 03:38:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<d4J1fB5HqIFnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.213.178.212
country_id: 1861060
description:
2025-12-30 03:39:04 dovecot_login authenticator failed for H=([154.213.178.212]) [154.213.178.212]:64180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 03:39:12 host2 sshd[1183116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 03:39:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<QYbmfx5H7t0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 03:40:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<g2t1gh5HZs8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 03:40:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Z1P3gh5H3NKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 03:42:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZuuJiB5HGMenrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Dec 30 03:42:17 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.255, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QfE+iR5HzsfN0h//>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-30 03:42:38 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:39067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-30 03:42:53 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:29695: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2025-12-30 03:43:17 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:46898: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:43:23 host2 sshd[1186147]: Disconnected from invalid user sammy 51.222.157.236 port 49304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 03:44:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ADTBjx5H7Dmi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec 30 03:44:14 host2 sshd[1187070]: Disconnected from invalid user bitrix 186.56.11.17 port 42654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 30 03:44:30 host2 sshd[1187303]: Disconnected from invalid user openstack 128.1.131.163 port 53938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 03:45:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<C25Wlh5HsS5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 03:45:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jnW7lB5HEMRCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:45:46 host2 sshd[1189328]: Disconnected from invalid user xiao 34.91.0.68 port 57038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:46:38 host2 sshd[1190332]: Disconnected from invalid user mohsen 117.250.96.66 port 40680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-30 03:46:49 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:54946: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:09 host2 sshd[1191054]: Disconnecting authenticating user root 90.226.39.62 port 37488: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-30 03:47:09 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:52829: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:09 host2 sshd[1191054]: error: maximum authentication attempts exceeded for root from 90.226.39.62 port 37488 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:47:48 host2 sshd[1191743]: Disconnected from invalid user marvin 193.123.68.117 port 12931 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:12 host2 sshd[1191120]: error: maximum authentication attempts exceeded for root from 90.226.39.62 port 38042 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:12 host2 sshd[1191120]: Disconnecting authenticating user root 90.226.39.62 port 38042: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:47:12 host2 sshd[1191158]: Disconnected from invalid user testuser 34.91.0.68 port 41562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:19 host2 sshd[1191257]: Disconnecting invalid user admin 90.226.39.62 port 39408: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:48:39 host2 sshd[1192555]: Disconnected from invalid user david 34.91.0.68 port 54318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:48:43 host2 sshd[1192606]: Disconnected from invalid user kocom 45.66.228.255 port 34734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-30 03:48:48 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:49497: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:49:40 host2 sshd[1193640]: Disconnected from invalid user portainer 193.123.68.117 port 62108 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-30 03:49:16 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:52310: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:49:29 host2 sshd[1193520]: Disconnected from invalid user bitrix 117.250.96.66 port 39948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:51:09 host2 sshd[1195460]: Disconnected from invalid user steam 45.66.228.255 port 37682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:50:52 host2 sshd[1195096]: Disconnected from invalid user uno85 193.123.68.117 port 43814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-30 03:51:05 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:46518: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:50:13 host2 sshd[1194271]: Disconnected from invalid user steam 117.250.96.66 port 53878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:50:33 host2 sshd[1194745]: Disconnected from invalid user guest 45.66.228.255 port 60998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:51:48 host2 sshd[1196009]: Disconnected from invalid user tobias 51.222.157.236 port 35982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec 30 03:51:11 host2 sshd[1195487]: Disconnected from invalid user openstack 186.56.11.17 port 54960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2025-12-30 03:51:24 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:34542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:52:17 host2 sshd[1196453]: Disconnected from invalid user openstack 51.222.157.236 port 45158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:54:12 host2 sshd[1198301]: Disconnected from invalid user bitrix 45.66.228.255 port 35854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.3.182
country_id: 1269750
description:
Dec 30 03:54:25 host2 sshd[1198508]: Disconnected from invalid user bitrix 139.59.3.182 port 50336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 03:54:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ZXdUtR5HgqwFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 03:55:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YlJ+tx5HtLKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 03:57:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ggwgwB5HDJ4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 03:58:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<aB3jwx5HcL8v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-30 03:59:31 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (ketene) [74.218.95.154]:42985: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 04:00:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<3H9Jyx5HvKGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 04:02:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<jTPLzx5H3KwzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 04:03:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Bp5e1R5HAPd100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.1
country_id: 6252001
description:
Dec 30 04:07:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.1, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wObU4x5H6Y7DuEwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.224
country_id: 6252001
description:
Dec 30 04:07:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.224, lip=66.85.158.91, TLS: Connection closed, session=<jw9x5B5H5bvDuEzg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 04:08:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<WxsQ5R5H1tynrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.230
country_id: 6252001
description:
Dec 30 04:08:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.230, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BSVF5R5HZ7rDuEzm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.31
country_id: 6252001
description:
Dec 30 04:08:06 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hnSZ5R5HkejDuEwf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.110
country_id: 6252001
description:
Dec 30 04:08:17 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.110, lip=66.85.158.91, TLS: Connection closed, session=<6Uc25h5Hn7nDuExu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.109
country_id: 6252001
description:
Dec 30 04:08:31 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.109, lip=66.85.158.91, TLS: Connection closed, session=<OHQS5x5HC4DDuExt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 04:12:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<VjBb9B5HtN6YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-30 04:17:50 dovecot_login authenticator failed for H=(victoryent.in) [111.93.80.158]:60644: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2025-12-30 04:18:16 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:45229: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 04:19:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BqG8DR9H8L8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 04:19:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJC0Dh9H/ocv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 04:20:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<Sd1ZER9HHM5V6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-30 04:20:11 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:38608: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 04:21:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XqNpFR9HdHAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 04:21:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<7EPBFh9HKPlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-30 04:23:29 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:43904: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-30 04:23:45 dovecot_login authenticator failed for H=([152.52.234.4]) [152.52.231.202]:43622: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 04:25:17 host2 pure-ftpd[1233112]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:26:42 host2 sshd[1234308]: Disconnected from invalid user colin 51.178.141.222 port 47650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 04:27:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Fk4FKx9HVtwyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:28:38 host2 sshd[1236692]: Disconnected from invalid user minecraft 51.178.141.222 port 48036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:28:58 host2 sshd[1237002]: Disconnected from invalid user smbguest 138.84.41.244 port 10070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:29:11 host2 sshd[1237214]: Disconnected from invalid user cristina 51.178.141.222 port 60480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:29:45 host2 sshd[1237857]: Disconnected from invalid user arma3server 138.84.41.244 port 34831 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:30:09 host2 sshd[1238782]: Disconnected from invalid user nc 51.178.141.222 port 57066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:30:33 host2 sshd[1241274]: Disconnected from invalid user fernanda 138.84.41.244 port 32123 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 04:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<S7CVNh9HdIpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-30 04:30:54 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:44380: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-12-30 04:31:06 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:44486: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:30:25 host2 sshd[1240096]: Disconnected from invalid user openvpn 151.240.0.197 port 47270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:31:39 host2 sshd[1242020]: Disconnected from invalid user kodi 151.240.0.197 port 53040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:32:17 host2 sshd[1242746]: Disconnected from invalid user vlc 151.240.0.197 port 39484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.105.91.164
country_id: 2017370
description:
Dec 30 04:33:24 host2 sshd[1243567]: Disconnected from invalid user ubuntu 185.105.91.164 port 53758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 04:33:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<o2c9QB9H0KKeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:33:47 host2 sshd[1243992]: Disconnected from invalid user rushi 151.240.0.197 port 40524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 04:33:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<n4jwQR9H8Nqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 04:35:35 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (pecoady) [76.106.163.189]:49634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 04:35:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oAvWSB9HmqEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-30 04:36:57 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:34022: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-30 04:37:08 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:46152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 04:37:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Fc0jUB9HNApniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 30 04:38:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<0zzvUB9HZPBChJmL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.82
country_id: 6252001
description:
Dec 30 04:39:28 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.82, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<O0DGVR9Hd93N0h9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 04:41:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Mga/XB9HZn2i8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.254.70.217
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 5.254.70.217 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:43:36 host2 sshd[1251689]: Disconnected from invalid user rocketmq 103.176.79.117 port 34954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 04:44:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<HMH5ZR9H8McvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 30 04:46:40 host2 sshd[1255112]: Disconnected from invalid user monitor 20.185.243.158 port 52262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 04:46:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<b4J6cB9H8tVCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-30 04:48:06 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:48478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.199.162.47
country_id: 597427
description:
Dec 30 04:47:11 host2 sshd[1255446]: Disconnected from invalid user zomboid 5.199.162.47 port 45726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-30 04:47:51 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:60090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.199.162.47
country_id: 597427
description:
Dec 30 04:48:14 host2 sshd[1256205]: Disconnected from invalid user admin 5.199.162.47 port 51794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-30 04:51:10 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (reptawle) [76.157.219.158]:43756: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 04:50:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N2fqfB9H+uSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:50:29 host2 sshd[1258471]: Disconnected from invalid user distro 103.176.79.117 port 39396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:51:17 host2 sshd[1259112]: Disconnected from invalid user abhi 103.176.79.117 port 60864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-30 04:58:39 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:55438: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-30 04:58:28 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:42895: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 04:59:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3jVvnB9HDE9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2025-12-30 04:59:26 dovecot_login authenticator failed for H=(abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:54796: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-30 04:59:41 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:38420: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 05:00:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VKQCoB9HwswFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 05:01:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Mwbjoh9HZoQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 05:02:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZzjHph9HIN+nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 05:01:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<PBXTpR9H9N0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 05:03:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<LdBWqx9HoNaeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 30 05:03:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TfDvrB9H2kFChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 05:05:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<w9eZsh9HntIzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Dec 30 05:08:15 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.140.14, lip=66.85.158.92, TLS, session=<3HurvB9HopdV2YwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.4
country_id: 732800
description:
Dec 30 05:11:15 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.215.4, lip=66.85.158.91, TLS, session=<Gypqxh9HI4G5/9cE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.104
country_id: 298795
description:
Dec 30 05:10:57 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=45.67.155.104, lip=66.85.158.91, TLS, session=<Ok9PxR9Hp80tQ5to>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 05:12:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<EYiGyx9HdJ8v+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 05:14:06 host2 sshd[1278850]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 05:14:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<EYpK0R9HFoOElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 05:16:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<w2dr2B9HYMOeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 05:16:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jI0B2x9Htn8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 05:18:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<olLI4h9HHuZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 30 05:22:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<ObKf7h9HntXE+2YM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 05:23:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<b/rp8R9HptAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 05:23:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<R96t8h9HKJhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 05:24:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eJAq9h9HQjZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 05:27:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7rXQACBH0Oai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 05:27:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<TY2uASBHIoyYNcU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 05:27:41 host2 pure-ftpd[1289279]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 05:28:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<VorKBCBH8pOnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.17.84
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.17.84 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.175.78
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.50.175.78 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.60.233
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.241.60.233 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.117.122.179
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.117.122.179 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 05:28:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<uo9ZBCBHSoieRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.34.225.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.34.225.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.9.37.201
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.9.37.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.12.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.12.141 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.38.3.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.38.3.27 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.60.213.95
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.60.213.95 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.184.171.155
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.184.171.155 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.164.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.181.164.244 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-30 05:28:50 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:57172: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.57.115.254
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.57.115.254 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.114.7
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.160.114.7 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.188.199.46
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 64.188.199.46 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 05:30:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dmvaDCBHHxdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 30 05:31:06 host2 sshd[1292131]: Disconnected from invalid user ircd 181.212.81.228 port 54108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 05:31:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4+IzDyBHaK0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 05:32:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (intismole) [87.103.126.54]:43405: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 05:32:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<97tAFCBHxsIyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.88.87
country_id: 2077456
description:
Dec 30 05:32:21 host2 sshd[1292943]: Disconnected from invalid user ftpuser 115.129.88.87 port 53670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 30 05:32:59 host2 sshd[1293461]: Disconnected from invalid user monitor 181.212.81.228 port 59894 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.20
country_id: 6252001
description:
Dec 30 05:35:11 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LQr/HCBH0N8UQcMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 30 05:35:24 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, session=<diXMHSBHCoKnXpI4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.25.150.161
country_id: 798544
description:
Dec 30 05:34:53 host2 sshd[1295035]: Disconnected from invalid user bot 185.25.150.161 port 40988 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.14.114.105
country_id: 130758
description:
Dec 30 05:36:03 host2 sshd[1296313]: Disconnected from invalid user ircd 31.14.114.105 port 39568 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 30 05:36:05 host2 pure-ftpd[1296355]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.88.87
country_id: 2077456
description:
Dec 30 05:37:28 host2 sshd[1297220]: Disconnected from invalid user tempuser 115.129.88.87 port 46937 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 05:39:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YdALLCBHLL+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-30 05:39:42 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:46654: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-12-30 05:40:14 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:37993: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 30 05:41:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS: Connection closed, session=<triPMiBHjgRChJlz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.248.118
country_id: 6252001
description:
Dec 30 05:45:02 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.248.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ElRDQCBHkpwoTPh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 05:46:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cxraQyBH+sKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 05:49:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<vblRTyBHwrYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 05:49:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<djtfUCBHAoBCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-30 05:51:59 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:59550: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-30 05:52:37 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54683: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-30 05:58:33 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:49848: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-30 05:58:48 dovecot_login authenticator failed for H=([222.124.249.133]) [203.130.212.59]:33524: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-30 05:59:03 dovecot_login authenticator failed for H=([90.173.78.90]) [90.173.78.90]:47037: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-30 05:59:22 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:35288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 06:03:26 host2 sshd[1318559]: Disconnected from invalid user admin 2.57.121.112 port 34242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 06:06:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5WH5iyBHlJ0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 06:05:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QJa9iSBHYqAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 06:06:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GM3eiyBHkuov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 06:06:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=</uFtjSBHDIAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 06:10:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<M/vJmSBH+IszTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2025-12-30 06:11:05 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:38012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:12:09 host2 sshd[1325001]: Disconnected from invalid user sentry 62.97.44.51 port 49174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Dec 30 06:11:33 host2 sshd[1324623]: Disconnected from invalid user minecraft 64.227.174.243 port 33420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:11:38 host2 sshd[1324660]: Disconnected from invalid user ts3bot 62.97.44.51 port 49620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-30 06:13:01 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:47456: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 06:13:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UaNfpCBHKu4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:12:41 host2 sshd[1325477]: Disconnected from invalid user louwg 62.97.44.51 port 56386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-30 06:13:29 dovecot_login authenticator failed for H=c80-216-181-233.bredband.tele2.se [80.216.181.233]:41900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 06:16:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qye0sCBHlMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 06:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<xjZ5tiBH2JJV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.174.243
country_id: 1269750
description:
Dec 30 06:18:22 host2 sshd[1329819]: Disconnected from invalid user gitlab-runner 64.227.174.243 port 55750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-30 06:19:02 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:54434: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.86.61.76
country_id: 6252001
description:
2025-12-30 06:19:15 dovecot_login authenticator failed for H=([208.86.61.76]) [208.86.61.76]:53550: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 06:19:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QPp+uyBH3NqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 06:21:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EILzwSBHINOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-30 06:23:03 dovecot_login authenticator failed for H=(189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:34863: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-30 06:23:17 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:48414: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 06:23:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VhQHyiBHqzxniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Dec 30 06:23:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.14, lip=66.85.158.91, TLS: Connection closed, session=<4JRUyyBH2o5V2YwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 06:24:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<e6R6zSBHBrCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 06:25:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<NCSXzyBH8MueRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-30 06:26:16 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (sulang) [196.47.172.253]:47596: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-30 06:25:43 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:50049: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-30 06:25:56 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:57321: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-30 06:27:24 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (allatory) [73.213.237.28]:38632: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 06:27:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<gNc22SBHxlsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 06:27:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZTqm2SBH1Nov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 06:28:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<sUKZ2iBHogVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 06:29:00 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:38432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-30 06:28:32 dovecot_login authenticator failed for H=([128.185.247.231]) [182.95.225.114]:34008: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


