# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 05:33:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<TIdtcFxHmsxCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:44 host2 pure-ftpd[3821077]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:46 host2 pure-ftpd[3821118]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:33:47 host2 pure-ftpd[3822422]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:33:44 host2 pure-ftpd[3822364]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 05:35:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PY2adlxHSIaYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Jan  2 05:36:52 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.92, TLS, session=<wWGRfFxHkEys7ORz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 05:36:59 host2 pure-ftpd[3825673]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 05:39:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<eIzdhlxHos0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 05:43:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DELPklxH/q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 05:48:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<g/VDpVxHkM+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-02 05:49:31 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:41614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-01-02 05:49:52 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:40050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 05:56:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tONCwlxHyNRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.249.77
country_id: 2921044
description:
Jan  2 05:56:35 host2 pure-ftpd[3847988]: (?@209.38.249.77) [INFO] New connection from 209.38.249.77


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.222.129
country_id: 2921044
description:
Jan  2 05:56:37 host2 pure-ftpd[3848025]: (?@209.38.222.129) [INFO] New connection from 209.38.222.129


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 05:58:08 host2 sshd[3849595]: Disconnected from invalid user newuser 34.142.110.144 port 44190 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 06:00:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LHOe0FxHMihniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:01:06 host2 sshd[3852706]: Disconnected from invalid user qwe 34.142.110.144 port 36400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:00:36 host2 sshd[3852234]: Disconnected from invalid user satya 34.142.110.144 port 53342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:01:36 host2 sshd[3853190]: Disconnected from invalid user mysftp 34.142.110.144 port 47686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 06:02:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<t7qW1lxHUsyeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.183
country_id: 798544
description:
Jan  2 06:02:21 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.232.165.183, lip=66.85.158.91, TLS, session=<Fri61lxHAdxb6KW3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:03:25 host2 sshd[3855187]: Disconnected from invalid user runner 151.34.224.247 port 33219 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:02:30 host2 sshd[3854081]: Disconnected from invalid user user 201.186.40.250 port 53786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.150
country_id: 298795
description:
Jan  2 06:02:40 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=45.67.155.150, lip=66.85.158.91, TLS, session=<p+3M11xHBbwtQ5uW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Jan  2 06:03:54 host2 sshd[3855663]: Disconnected from invalid user ubuntu 139.59.26.79 port 44410 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:04:03 host2 sshd[3855866]: Disconnected from invalid user 2 201.186.40.250 port 53532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:04:21 host2 sshd[3856206]: Disconnected from invalid user es 102.88.137.213 port 49838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan  2 06:03:38 host2 sshd[3855390]: Disconnected from invalid user satya 103.187.165.26 port 44830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan  2 06:05:06 host2 sshd[3857074]: Disconnected from invalid user mata 103.187.165.26 port 46042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:04:46 host2 sshd[3856602]: Disconnected from invalid user website 201.186.40.250 port 39280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:05:41 host2 sshd[3857918]: Disconnected from invalid user raghu 102.88.137.213 port 49758 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 159.203.117.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 159.203.117.74: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.3
country_id: 798549
description:
Jan  2 06:05:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.3, lip=66.85.158.92, session=<zlci5FxHEMZV2ZUD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-02 06:07:02 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:52946: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2026-01-02 06:07:15 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:60928: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:06:59 host2 sshd[3859188]: Disconnected from invalid user ubuntu 102.88.137.213 port 49712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:07:37 host2 sshd[3859997]: Disconnected from invalid user botuser 151.34.224.247 port 33902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 06:08:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aXMX7VxH0KsjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.120
country_id: 6252001
description:
Jan  2 06:08:31 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.120, lip=66.85.158.92, TLS, session=<7Cu77VxHeOSTuYR4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:09:31 host2 sshd[3861934]: Disconnected from invalid user bot 151.34.224.247 port 33043 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.156
country_id: 3865483
description:
Jan  2 06:09:32 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=181.118.183.156, lip=66.85.158.91, TLS, session=<FVFH8FxHSdK1drec>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.12.73.231
country_id: 690791
description:
Jan  2 06:09:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.12.73.231, lip=66.85.158.91, TLS, session=<SmJ58VxHus3CDEnn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:09:54 host2 sshd[3862311]: Invalid user sivagnanamfoundation from 93.123.109.114 port 35324


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Jan  2 06:11:29 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<dEs1+FxHFNzE+2YO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.171.152.138
country_id: 783754
description:
Jan  2 06:10:50 host2 pure-ftpd[3863523]: (?@31.171.152.138) [INFO] New connection from 31.171.152.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.244
country_id: 3686110
description:
Jan  2 06:10:53 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.16.244, lip=66.85.158.91, session=<qpcv9lxHxJiaLxD0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.26
country_id: 597427
description:
Jan  2 06:10:53 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.132.194.26, lip=66.85.158.91, session=<ypEz9lxHuJgthMIa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 154.47.23.3
country_id: 1861060
description:
Jan  2 06:15:41 host2 dovecot[3680762]: imap-login: Disconnected: Input buffer full (disconnected before auth was ready, waited 0 secs): user=<>, rip=154.47.23.3, lip=66.85.158.91, session=<S2dcB11HkraaLxcD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.5
country_id: 1327865
description:
Jan  2 06:15:41 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.41.5, lip=66.85.158.91, session=<YKlhB11HirZinykF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 06:16:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+hjgCV1HerQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 06:21:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<On3LGl1HPpqeRdY+>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 167.172.239.37
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 167.172.239.37: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.158
country_id: 3703430
description:
Jan  2 06:22:41 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.126.158, lip=66.85.158.91, session=<7fxmIF1HUJhbWn6e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.163
country_id: 2993457
description:
Jan  2 06:22:41 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.233.163, lip=66.85.158.91, session=<hwVkIF1HWJhftemj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 06:23:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<cEGSIl1HoPui8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 06:23:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7jtlJF1HNLEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 06:24:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</vOMJV1HtsZ100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:24:18 host2 sshd[3878777]: Disconnected from invalid user bitwarden 151.34.224.247 port 33147 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:24:35 host2 sshd[3879055]: Invalid user sivagnanamfoundation from 93.123.109.114 port 48224


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 06:25:03 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Fdy+KF1HBlQjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.244.98
country_id: 2782113
description:
[2026-01-02 06:27:39 +0530] info [cpaneld] 146.70.244.98 - kamechot "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-02 06:29:09 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (mencisted) [71.235.225.181]:41232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:30:30 host2 sshd[3885884]: Disconnected from invalid user admin 202.8.127.134 port 53926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.144
country_id: 6252001
description:
Jan  2 06:31:46 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.144, lip=66.85.158.92, TLS, session=<YofpQF1HmvzN0h+Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-02 06:32:23 dovecot_plain authenticator failed for H=(relly) [65.20.129.28]:40945: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:32:25 host2 sshd[3888197]: Disconnected from invalid user crawl 152.42.203.0 port 48152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:32:36 host2 sshd[3888408]: Disconnected from invalid user ahmed 190.167.90.67 port 52971 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:32:31 host2 sshd[3888283]: Disconnected from invalid user wy 8.154.2.19 port 33664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 06:34:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49724: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:33:34 host2 sshd[3889645]: Disconnected from invalid user david 202.8.127.134 port 56240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-02 06:34:03 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (subale) [73.168.136.150]:49742: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.93.42.149
country_id: 1269750
description:
2026-01-02 06:34:02 dovecot_login authenticator failed for H=149.42.93.34.bc.googleusercontent.com (10.160.0.2) [34.93.42.149]:51705: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:35:00 host2 sshd[3891505]: Disconnected from invalid user testusr 8.154.2.19 port 50268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:35:08 host2 sshd[3891873]: Disconnected from invalid user sdc 152.42.203.0 port 54570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 06:35:58 host2 sshd[3892959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:36:09 host2 sshd[3893170]: Disconnected from invalid user linus 8.154.2.19 port 48484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:36:15 host2 sshd[3893270]: Disconnected from invalid user teamspeak 202.8.127.134 port 46820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:35:57 host2 sshd[3892923]: Disconnected from invalid user lisi 107.173.10.98 port 52032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:37:10 host2 sshd[3894424]: Disconnected from invalid user ss 190.167.90.67 port 38049 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.89
country_id: 6252001
description:
Jan  2 06:37:11 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.89, lip=66.85.158.91, session=<qQs9VF1HlNcUQGhZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:37:12 host2 sshd[3894463]: Disconnected from invalid user teamspeak 152.42.203.0 port 53696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:36:37 host2 sshd[3893735]: Disconnected from invalid user denis 103.210.21.178 port 50748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:37:36 host2 sshd[3894907]: Disconnected from invalid user crawl 86.54.42.252 port 49186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:37:33 host2 sshd[3894821]: Disconnected from invalid user vpn 117.247.111.70 port 12418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:37:53 host2 sshd[3895172]: Disconnected from invalid user user 152.42.203.0 port 41330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:38:11 host2 sshd[3895534]: Disconnected from invalid user testuser 190.167.90.67 port 51370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.130.227.106
country_id: 1512440
description:
Jan  2 06:38:46 host2 sshd[3896123]: Disconnected from invalid user team1 95.130.227.106 port 40204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:38:52 host2 sshd[3896269]: Disconnected from invalid user orca 103.210.21.178 port 47568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:39:09 host2 sshd[3896578]: Disconnected from invalid user ali 152.42.203.0 port 35352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:39:18 host2 sshd[3896792]: Invalid user sivagnanamfoundation from 93.123.109.114 port 46132


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:39:24 host2 sshd[3896876]: Disconnected from invalid user openkm 117.247.111.70 port 63728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:38:37 host2 sshd[3896013]: Disconnected from invalid user smart 86.54.42.252 port 34226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 06:38:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<nis3Wl1HhKsv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:39:06 host2 sshd[3896543]: Received disconnect from 86.54.42.252 port 45738:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:39:09 host2 sshd[3896607]: Disconnected from invalid user vpn 190.167.90.67 port 37967 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 06:39:29 host2 pure-ftpd[3896962]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:40:00 host2 sshd[3897510]: Disconnected from invalid user admin 103.210.21.178 port 39312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:40:06 host2 sshd[3897781]: Disconnected from invalid user develop 190.167.90.67 port 52343 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Jan  2 06:39:29 host2 sshd[3896927]: Disconnected from invalid user jules 152.32.250.188 port 60020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 06:41:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<AkXvYl1Hhtlo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:40:38 host2 sshd[3898367]: Disconnected from invalid user ahmed 117.247.111.70 port 22361 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:41:56 host2 sshd[3899732]: Disconnected from invalid user sanjay 107.173.10.98 port 3418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.130.227.106
country_id: 1512440
description:
Jan  2 06:42:20 host2 sshd[3900345]: Disconnected from invalid user uploader 95.130.227.106 port 60282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 06:41:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7yLYZF1HMM1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:43:56 host2 sshd[3901943]: Disconnected from invalid user sistema 107.173.10.98 port 7800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:46:45 host2 sshd[3905351]: Disconnected from invalid user soporte 107.173.10.98 port 38486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:47:51 host2 sshd[3906847]: Disconnected from invalid user vikas 107.173.10.98 port 4012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 06:47:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jNAqeV1HTtii8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.49
country_id: 6252001
description:
Jan  2 06:51:07 host2 pure-ftpd[3910521]: (?@205.210.31.49) [INFO] New connection from 205.210.31.49


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:54:21 host2 sshd[3913998]: Invalid user sivagnanamfoundation from 93.123.109.114 port 59154


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 06:55:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pgnBlF1Hswlniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Jan  2 06:55:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.36, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<USTVlF1Hns7G6xgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Jan  2 06:58:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<7MK7oV1H5pzE+2YM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 07:03:18 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<5hyNsV1H7IWeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.244.90
country_id: 2782113
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 146.70.244.90 - kamechot "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 07:03:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<hRhksl1HpslCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 07:06:08 host2 sshd[3926953]: Disconnected from invalid user admin 2.57.121.112 port 58376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 07:06:48 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ZBAUvl1HQKUvWBNS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 07:10:19 host2 sshd[3931542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 07:09:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IJELyV1H7MFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 07:11:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qllT0F1HqG0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.3.43.242
country_id: 1269750
description:
Jan  2 07:12:32 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=103.3.43.242, lip=66.85.158.91, TLS, session=<8YVs0V1HhtFnAyvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 73.128.151.92
country_id: 6252001
description:
Jan  2 07:12:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<marketing>, method=PLAIN, rip=73.128.151.92, lip=66.85.158.91, TLS, session=<rYm90l1H1olJgJdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-02 07:17:03 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:35121: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:17:55 host2 sshd[3940019]: Disconnected from invalid user hasan 218.190.8.165 port 60116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 07:19:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<EPJO6l1HOI+eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:19:55 host2 sshd[3942433]: Disconnected from invalid user ubuntu 218.190.8.165 port 58318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 07:20:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<L0EC7l1HVK4yBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:20:39 host2 sshd[3943446]: Disconnected from invalid user newuser 162.223.91.130 port 37308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:21:13 host2 sshd[3944072]: Disconnected from invalid user grid 218.190.8.165 port 53924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-02 07:22:26 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:43666: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:21:46 host2 sshd[3944641]: Disconnected from invalid user username 162.223.91.130 port 33930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:21:49 host2 sshd[3944673]: Disconnected from invalid user wg 218.190.8.165 port 37610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:22:46 host2 sshd[3945669]: Disconnected from invalid user low 162.223.91.130 port 58786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 07:22:33 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<z9lg9l1HxuyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-02 07:22:38 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:47304: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 07:23:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<99PC+V1HnbN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 07:23:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<yFd0+l1Hrtgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Jan  2 07:24:46 host2 sshd[3947532]: Disconnected from invalid user python 152.32.253.205 port 59834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 07:25:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9XGYAl5Hsuui8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:26:03 host2 sshd[3948924]: Disconnected from invalid user user01 162.240.212.247 port 35404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 07:25:29 host2 sshd[3948338]: Disconnected from invalid user user 2.57.121.25 port 34608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:26:47 host2 sshd[3949653]: Disconnected from invalid user devops 162.240.212.247 port 50114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:27:25 host2 sshd[3950283]: Disconnected from invalid user ftb 162.240.212.247 port 35704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 07:28:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sVvOC15H+q4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:29:18 host2 sshd[3952245]: Disconnected from invalid user devops 70.54.182.130 port 54104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Jan  2 07:30:34 host2 sshd[3953541]: Disconnected from invalid user owner 103.101.216.74 port 57434 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - greentar "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.216.74
country_id: 1643084
description:
Jan  2 07:31:53 host2 sshd[3954740]: Disconnected from invalid user user 103.101.216.74 port 52308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Jan  2 07:33:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<qeIWHF5HxJS4affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Jan  2 07:33:32 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<lIPDHV5HLia4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:34:40 host2 sshd[3957819]: Disconnected from invalid user user1 70.54.182.130 port 54504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:35:37 host2 sshd[3958923]: Disconnected from invalid user comfort 51.195.138.37 port 60184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 07:35:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KjbYJV5HHKeYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-02 07:36:26 dovecot_plain authenticator failed for H=(gragic) [24.187.213.29]:43484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:36:37 host2 sshd[3960062]: Disconnected from invalid user sk 124.156.243.35 port 53750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:37:20 host2 sshd[3961204]: Disconnected from invalid user es 70.54.182.130 port 55596 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.119
country_id: 3017382
description:
Jan  2 07:38:11 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NLpuLl5HX8Vb51l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.115
country_id: 3017382
description:
Jan  2 07:38:22 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.115, lip=66.85.158.91, TLS: Connection closed, session=</eEQL15HfaBb51lz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.201
country_id: 3017382
description:
Jan  2 07:38:36 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.201, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cETvL15HLaRb51nJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.113
country_id: 3017382
description:
Jan  2 07:38:40 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.113, lip=66.85.158.91, TLS: Connection closed, session=<u14fMF5HWe1b51lx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:39:49 host2 sshd[3963667]: Disconnected from invalid user proxyuser 70.54.182.130 port 48818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 07:40:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+gy6NV5HqsJn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:39:43 host2 sshd[3963572]: Disconnected from invalid user james 124.156.243.35 port 48744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-02 07:40:41 dovecot_plain authenticator failed for H=(clized) [109.226.27.227]:46415: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:40:50 host2 sshd[3964732]: Disconnected from invalid user ron 51.195.138.37 port 42808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:41:05 host2 sshd[3964968]: Disconnected from invalid user downloader 124.156.243.35 port 56832 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 07:42:10 host2 pure-ftpd[3966075]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:42:20 host2 sshd[3966251]: Disconnected from invalid user luser 124.156.243.35 port 48316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Jan  2 07:41:44 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NtkjO15HL8fG6xjQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:41:52 host2 sshd[3965747]: Disconnected from invalid user db 51.195.138.37 port 53098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:43:33 host2 sshd[3967760]: Disconnected from invalid user ftp_user 124.156.243.35 port 34634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.124
country_id: 1643084
description:
Jan  2 07:44:06 host2 sshd[3968393]: Disconnected from invalid user ftp_user 103.171.85.124 port 59518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Jan  2 07:44:51 host2 sshd[3969138]: Disconnected from invalid user mobiquity 103.171.85.124 port 52724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:45:11 host2 sshd[3969713]: Disconnected from invalid user ftb 189.47.10.77 port 46588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 07:45:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<j4KfR15HusKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 07:46:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JirfS15HtoMv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 07:47:03 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<CdT+TV5HMoMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 07:47:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iXJgTl5HKLai8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.126
country_id: 3017382
description:
Jan  2 07:47:12 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r2+iTl5HSZBbxJh+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.38
country_id: 3017382
description:
Jan  2 07:47:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.38, lip=66.85.158.91, TLS: Connection closed, session=<PDFGT15HH95bxJgm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Jan  2 07:47:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.32, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jZoGUF5Hi5xbxJgg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.122
country_id: 3017382
description:
Jan  2 07:47:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.122, lip=66.85.158.91, TLS: Connection closed, session=<R5c2UF5HWeFbxJh6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.117
country_id: 6252001
description:
Jan  2 07:49:21 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.117, lip=66.85.158.92, session=</H9ZVl5H9N8UQcJ1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 07:49:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KIYxWF5HgzNniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:50:54 host2 sshd[3977402]: Disconnected from invalid user adminuser 189.47.10.77 port 59588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:52:32 host2 sshd[3979155]: Disconnected from invalid user artem 189.47.10.77 port 50856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  2 08:04:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<k1+ZjF5HBIYFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 08:05:06 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aHSPjl5HYN6eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-02 08:06:34 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nonater) [87.103.126.54]:4782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 08:09:46 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FvNBn15HXJNo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.214.20.142
country_id: 2077456
description:
2026-01-02 08:10:59 dovecot_plain authenticator failed for H=([192.168.1.5]) [103.214.20.142]:50963: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 08:15:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EWp+tF5HVmMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:16:39 host2 pure-ftpd[4006811]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:16:43 host2 pure-ftpd[4006897]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:17:30 host2 pure-ftpd[4007973]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:17:32 host2 pure-ftpd[4008010]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 08:22:18 host2 sshd[4013396]: Disconnected from invalid user admin 2.57.121.112 port 65329 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 08:23:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<G+KLzl5HXLFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 08:23:33 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<biiL0F5HjTt100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 08:24:26 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8Cqx015HotKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 08:28:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<KL2A4F5HGBii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 08:31:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SLKg7F5HTs8v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 213.176.19.20
country_id: 2017370
description:
Jan  2 08:30:35 host2 pure-ftpd[4022321]: (?@213.176.19.20) [INFO] New connection from 213.176.19.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 08:32:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MGEq8F5HOIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 08:34:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GSBX915HFJJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:36:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRHL/l5Ho8+TuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:37:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</YYCAV9HdPGTuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:37:51 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<01DSA19HuPSTuYW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 08:37:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZevnA19Hospn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 08:44:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WXY1Gl9HsBVniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 08:44:52 host2 pure-ftpd[4037608]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<nUllHV9HNPiTuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<WSeBH19HquiTuYW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 08:47:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ksGYJF9HJMCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 08:49:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NmCeLV9HTK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 08:53:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ftpcPV9HtLcv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 08:54:34 host2 sshd[4050140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 09:00:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<YMEzU19H6rMyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:00:12 host2 sshd[4056312]: Disconnected from invalid user admin 103.250.11.116 port 57264 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 09:03:42 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:04:38 host2 sshd[4060950]: Disconnected from invalid user ubuntu 103.250.11.116 port 44612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:05 host2 sshd[4062662]: Disconnected from invalid user root2 103.250.11.116 port 60928 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-02 09:06:35 +0530] info [cpaneld] 34.27.42.6 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:49 host2 sshd[4063349]: Disconnected from invalid user testftp 103.250.11.116 port 46442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:07:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N6fhbF9H/NieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Jan  2 09:08:31 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<emghcF9H76lnpPaX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.195
country_id: 3469034
description:
Jan  2 09:08:52 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.199.195, lip=66.85.158.91, TLS, session=<lzOhcV9HINKzvcfD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:11:11 host2 sshd[4068175]: Disconnected from invalid user jerry 139.59.225.112 port 41404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 09:11:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<et8BfV9H8JYFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:15:08 host2 sshd[4072422]: Disconnected from invalid user teamspeak 95.38.101.192 port 56106 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  2 09:16:55 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<S5KHj19HyNFChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:17:26 host2 sshd[4074768]: Disconnected from invalid user ts 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:16:43 host2 sshd[4074045]: Disconnected from invalid user ts3server 95.38.101.192 port 56228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:18:03 host2 sshd[4075413]: Disconnected from invalid user michael 20.76.82.176 port 12289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:27 host2 sshd[4075956]: Disconnected from invalid user asep 159.89.143.86 port 50432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:19:21 host2 sshd[4076900]: Disconnected from invalid user git 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:19:29 host2 sshd[4077007]: Disconnected from invalid user jon 159.89.143.86 port 41512 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Received disconnect from 159.89.143.86 port 57276:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Disconnected from invalid user jerry 159.89.143.86 port 57276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:20:18 host2 sshd[4077996]: Disconnected from invalid user asep 139.59.225.112 port 42114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:19:30 host2 sshd[4077035]: Disconnected from invalid user orange 193.23.218.198 port 51006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:19:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<z+vZmV9HhH0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, session=<yRtGol9HKh+d5jPj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 pure-ftpd[4079881]: (?@157.230.51.227) [INFO] New connection from 157.230.51.227


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FAZ5o19H3MSd5jPj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:23:48 host2 sshd[4081767]: Disconnected from invalid user mumbleserver 193.23.218.198 port 34234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 09:24:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cPDrqF9HCbR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.160.102.30
country_id: 3489940
description:
2026-01-02 09:24:19 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [69.160.102.30]:18050: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:24:22 host2 sshd[4082428]: Disconnected from invalid user test01 193.23.218.198 port 58262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, session=<t1i5q19H/haqQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 pure-ftpd[4082887]: (?@170.64.227.24) [INFO] New connection from 170.64.227.24


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:25:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lIs8rl9HbF6qQOMY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:26:41 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Tv9Ssl9HGqWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 09:30:39 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oZOCwF9HQLqi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:30:48 dovecot_login authenticator failed for H=(QnC8Cz) [69.5.189.21]:51374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:30:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<g+iIwV9HOQOd5jPj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:31:44 dovecot_login authenticator failed for H=(CAeeFEeW) [69.5.189.21]:60018: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:33:42 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wZ+Fy19HngOqQOMY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 09:36:16 host2 sshd[4097362]: Disconnected from invalid user admin 2.57.121.112 port 32074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 09:36:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z1k/1V9HFtdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-02 09:37:18 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (cemer) [73.161.96.107]:57370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-02 09:37:22 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (clatic) [24.98.45.238]:41734: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:36:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<s0mT1V9HbIcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 09:36:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<bHov1l9Hjqxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 09:39:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<vLdx3l9HtL2YNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 09:39:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eb5m319HAh1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:39:19 host2 sshd[4100601]: Disconnected from invalid user anes 156.227.236.175 port 36708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 09:39:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<s0us319Hmpcv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:39:37 host2 sshd[4100899]: Disconnected from invalid user ubuntu 187.140.204.135 port 53318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.30
country_id: 1819730
description:
Jan  2 09:39:43 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.30, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ffgJ4V9Hgpotjpoe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 09:39:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GoSp4V9Hqhto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:40:55 host2 sshd[4102427]: Disconnected from invalid user ubuntu 187.140.204.135 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:41:12 host2 sshd[4102765]: Disconnected from invalid user test 154.221.28.214 port 55950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:41:31 host2 sshd[4103124]: Disconnected from invalid user sftpuser 187.140.204.135 port 38532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:42:44 host2 sshd[4104384]: Disconnected from invalid user ubuntu 187.140.204.135 port 38058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:44:30 host2 sshd[4106132]: Disconnected from invalid user odoo 156.227.236.175 port 51418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:43:33 host2 sshd[4105220]: Disconnected from invalid user ubuntu 154.90.59.75 port 43962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:43:37 host2 sshd[4105316]: Disconnected from invalid user miguel 64.227.188.192 port 57804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:43:47 host2 sshd[4105457]: Disconnected from invalid user django 41.111.162.34 port 5256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:45:29 host2 sshd[4107430]: Disconnected from invalid user minh 64.227.188.192 port 42738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:44:51 host2 sshd[4106464]: Disconnected from invalid user sshuser 64.227.188.192 port 35246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:45:52 host2 sshd[4107896]: Disconnected from invalid user dino 41.111.162.34 port 21148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:46:22 host2 sshd[4108530]: Disconnected from invalid user chen 154.221.28.214 port 58344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:46:57 host2 sshd[4109378]: Disconnected from invalid user www 41.111.162.34 port 50484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:47:19 host2 sshd[4109838]: Disconnected from invalid user ubuntu 64.227.188.192 port 44188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:46:40 host2 sshd[4109035]: Disconnected from invalid user minh 154.90.59.75 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:46:54 host2 sshd[4109341]: Disconnected from invalid user admin 156.227.236.175 port 60534 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 09:47:33 host2 pure-ftpd[4110124]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 09:47:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65456: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 09:47:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<py1+/V9Hfsei8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:47:46 host2 sshd[4110364]: Disconnected from invalid user ftp01 154.221.28.214 port 38344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:49:11 host2 sshd[4111804]: Disconnected from invalid user server1 154.221.28.214 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.18
country_id: 2186224
description:
2026-01-02 09:50:53 dovecot_login authenticator failed for H=([121.73.163.18]) [121.73.163.18]:54886: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2026-01-02 09:51:03 dovecot_login authenticator failed for H=(cm-84.210.214.212.get.no) [84.210.214.212]:37040: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:51:12 host2 sshd[4114342]: Disconnected from invalid user jimmy 154.221.28.214 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-02 09:53:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (amiscer) [73.88.196.91]:59810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 09:55:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<csthGmBHLOKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 10:02:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Rk16MmBHUKkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:03:33 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<JzlLNmBHAIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:06:25 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ZyyGQGBHcLADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 10:06:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1t0sQWBHnrZCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:08:53 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<bPJZSWBH3uYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:09:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jHuCS2BH/uueRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:10:57 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ds+7UGBHDrwDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:11:49 host2 dovecot[3680762]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<MIzWU2BH7LUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.43.59
country_id: 3469034
description:
Jan  2 10:13:17 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=138.122.43.59, lip=66.85.158.91, TLS, session=<u8v1V2BHKrOKeis7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:30 host2 pure-ftpd[4145787]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-02 10:19:30 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:58026: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:34 host2 pure-ftpd[4145862]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-02 10:19:44 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:58356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:57 host2 pure-ftpd[4146294]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:59 host2 pure-ftpd[4146372]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2026-01-02 10:20:06 dovecot_login authenticator failed for H=([49.124.152.248]) [49.124.152.248]:54778: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-01-02 10:20:22 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:57222: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:57 host2 pure-ftpd[4147609]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:59 host2 pure-ftpd[4147653]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 10:22:46 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Ae/WemBH0u2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 10:24:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jQjkf2BH0GkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 10:25:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tmzZg2BHnUJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:29:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Y5U6kWBHupSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 10:34:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</2hHpmBHw0lniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 10:34:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Lo9To2BH2uSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 10:34:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<K0n1pGBHRLwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 10:35:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9mowqWBHFu5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  2 10:36:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<4IklrWBHIpeLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 10:38:02 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XP5lsWBH1JkFhXlo>


