# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 00:24:24 host2 pure-ftpd[3470872]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-02 00:28:01 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:42358: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-02 00:27:46 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:49490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:28:32 host2 sshd[3475039]: Disconnected from invalid user steam 134.122.121.56 port 38822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  2 00:30:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<dbI/M1hHdMYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 00:30:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<BrbCM1hHOuovWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:31:33 host2 sshd[3478471]: Disconnected from invalid user cxy 134.122.121.56 port 35312 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Jan  2 00:31:44 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, session=<OMVUOVhHmq5APsXF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:32:19 host2 sshd[3479435]: Disconnected from invalid user minecraft 134.122.121.56 port 41474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-02 00:34:17 dovecot_plain authenticator failed for H=(paric) [24.187.213.29]:60934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 00:34:25 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tFDBQlhHtylniu0S>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[38420] [Authentication Database]=[mail] [Username]=[no-reply@dataesite.lk] (10/10 failures) (blocked until [Fri Jan  2 19:05:12 2026 UTC/Sat Jan  3 00:35:12 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  2 00:35:14 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<imuuRVhHFJYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 00:35:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Tr76RlhH1gZ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.105
country_id: 6252001
description:
Jan  2 00:37:09 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rVW2TFhHHd+TuYRp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.12
country_id: 1327865
description:
Jan  2 00:39:49 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.41.12, lip=66.85.158.91, session=<4Kw+VlhH7IZinykM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.20.218
country_id: 1861060
description:
Jan  2 00:39:49 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=154.47.20.218, lip=66.85.158.91, session=<9XQ/VlhHaI6aLxTa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.175
country_id: 1819730
description:
Jan  2 00:39:50 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.17.56.175, lip=66.85.158.91, session=<ceFDVlhHPpNUETiv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.149
country_id: 1819730
description:
Jan  2 00:39:50 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.17.56.149, lip=66.85.158.91, session=<KhJFVlhHKKlUETiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.206.9
country_id: 2750405
description:
Jan  2 00:39:52 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=181.214.206.9, lip=66.85.158.91, TLS, session=<tLBsVlhHerW11s4J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.76
country_id: 2921044
description:
Jan  2 00:39:52 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=181.214.173.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9eNsVlhHeLW11q1M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.49
country_id: 3624060
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.10.49, lip=66.85.158.91, TLS, session=<C5XRV1hHZNeSRgox>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.217
country_id: 3190538
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.217, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tabRV1hHVtfDUJbZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.76
country_id: 2921044
description:
Jan  2 00:40:17 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.173.76, lip=66.85.158.91, session=<6iXcV1hHbry11q1M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.45
country_id: 3624060
description:
Jan  2 00:40:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.10.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LXjfV1hH6r+SRgot>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.146.55.165
country_id: 732800
description:
Jan  2 00:40:14 host2 pure-ftpd[3488309]: (?@156.146.55.165) [INFO] New connection from 156.146.55.165


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.141.232
country_id: 617790
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.175.141.232, lip=66.85.158.91, session=<ApLYV1hHjiKyr43o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.11
country_id: 3041565
description:
Jan  2 00:40:16 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.217.11, lip=66.85.158.91, session=<yITWV1hHnqGt79kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.99.199
country_id: 2510769
description:
Jan  2 00:40:16 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.253.99.199, lip=66.85.158.91, session=<P9zYV1hHeKG5/WPH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.132
country_id: 289688
description:
Jan  2 00:40:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.234.132, lip=66.85.158.91, TLS, session=<AZbhV1hH+r9fteqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.188.182.122
country_id: 2635167
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=203.188.182.122, lip=66.85.158.91, session=<4DfVV1hHgLzLvLZ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 00:46:43 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BabFblhHWqEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 00:49:30 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<58i/eFhHFOyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 00:50:10 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hUYde1hHiLAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 00:53:09 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<lVDBhVhHVJhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 00:56:29 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lTmtkVhHAHEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 00:58:21 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<hk1jmFhH8FNo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Jan  2 01:00:11 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZIAJn1hH1AlChJmE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 01:00:42 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<e1DHoFhHmoOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 01:03:45 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<hT+sq1hHdqAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 01:08:26 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OT90vFhHGtov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:09:51 host2 sshd[3517762]: Disconnected from invalid user administrator 39.109.104.252 port 59404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 01:10:10 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<WAabwlhH6KhCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:11:37 host2 sshd[3519604]: Disconnected from invalid user centos 39.109.104.252 port 59040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 01:12:25 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CiWsylhHaNNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 01:12:42 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kSC4y1hHhGEjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 01:14:04 host2 sshd[3521958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:13:14 host2 sshd[3521278]: Disconnected from invalid user user1 39.109.104.252 port 58674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 01:16:04 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<rWS/11hH4Lui8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.215
country_id: 2782113
description:
Jan  2 01:17:34 host2 dovecot[3488397]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=37.19.223.215, lip=66.85.158.91, session=<SVgy3VhH8IElE9/X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  2 01:17:57 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS: Connection closed, session=<fFad3lhHCDxChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:17:16 host2 sshd[3524834]: Disconnected from invalid user steam1 39.109.104.252 port 43638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.159
country_id: 1210997
description:
Jan  2 01:17:33 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.40.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s+Ul3VhHVr1inyif>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.59.140
country_id: 798544
description:
Jan  2 01:17:33 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.199.59.140, lip=66.85.158.91, TLS, session=<3eck3VhHyp2KxzuM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.132
country_id: 289688
description:
Jan  2 01:17:34 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.132, lip=66.85.158.91, session=<oio33VhHzpRfteqE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 01:18:40 host2 sshd[3526459]: Disconnected from invalid user admin 2.57.121.112 port 55591 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 01:19:26 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rSvM41hH2OGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.103
country_id: 3175395
description:
Jan  2 01:20:20 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=217.26.178.103, lip=66.85.158.91, TLS, session=<SOok5lhHreDZGrJn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.223.251.9
country_id: 2395170
description:
Jan  2 01:20:57 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 0 secs): user=<>, method=PLAIN, rip=41.223.251.9, lip=66.85.158.91, session=<5Q1S6VhHz6Mp3/sJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.210
country_id: 6252001
description:
Jan  2 01:21:08 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mRr26VhHjeRAPsXS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.23
country_id: 2300660
description:
Jan  2 01:21:13 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<charanaw>, method=PLAIN, rip=41.139.18.23, lip=66.85.158.91, TLS, session=<oVfd6FhHc5IpixIX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Jan  2 01:21:24 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.197, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Xpj06lhHVixAPsXF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 01:27:03 host2 pure-ftpd[3534982]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 01:28:27 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oOMGBFlHOgpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 01:33:07 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<A229FFlHKkF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:32:30 dovecot_login authenticator failed for H=(rljjjCwQc) [98.142.247.48]:65487: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:33:14 dovecot_login authenticator failed for H=(XjEgsQpVZ) [98.142.247.48]:65055: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:36:00 dovecot_login authenticator failed for H=(Ozxirx5u9) [98.142.247.48]:51878: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 98.142.247.48
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[98.142.247.48] [Authentication Database]=[mail] [Username]=[inquire@lezzarotech.com] (5/5 failures) (blocked until [Thu Jan  1 20:20:58 2026 UTC/Fri Jan  2 01:50:58 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan  2 01:36:37 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rQ1gIVlHFMHN0h+l>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.113
country_id: 6252001
description:
Jan  2 01:37:32 host2 pure-ftpd[3547024]: (?@20.65.193.113) [INFO] New connection from 20.65.193.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:02 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:09 dovecot_login authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 01:43:56 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1mhrO1lHqMeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.185.225
country_id: 2510769
description:
Jan  2 01:44:39 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=5.183.185.225, lip=66.85.158.91, TLS, session=<dwYHPVlHVMMFt7nh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.150.73.26
country_id: 3057568
description:
Jan  2 01:45:25 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<env_eng>, method=PLAIN, rip=193.150.73.26, lip=66.85.158.91, TLS, session=<xNlCP1lHpAnBlkka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  2 01:46:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<5xRZRVlHgP/CpRCj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 01:48:16 host2 sshd[3557714]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 01:49:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NY/8T1lHiK6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 01:49:58 host2 sshd[3559315]: Disconnected from invalid user admin 2.57.121.112 port 65424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 01:50:51 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OZ0jVFlHQOBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 01:51:38 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qinxVllHqMMv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  2 01:57:27 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, session=<6n7ca1lHgva5qQRo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 01:58:18 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4ELDbllHJpIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 02:01:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<PtsleVlHYMKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Jan  2 02:03:35 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, session=<l6XNgVlHRv/N0h9s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 02:07:45 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tv6VkFlHhpMvWBNS>


