# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Dec 27 15:14:40 host2 sshd[2132415]: Disconnected from invalid user web 177.0.212.86 port 41083 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.157.206.168
country_id: 3469034
description:
Dec 27 15:14:52 host2 sshd[2132571]: Disconnected from invalid user game 177.157.206.168 port 54380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:15:15 host2 sshd[2133034]: Disconnected from invalid user avahi 198.98.56.205 port 46312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-27 15:16:58 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:42039: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-27 15:16:32 dovecot_login authenticator failed for H=([59.99.153.21]) [59.99.153.21]:38904: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:17:52 host2 sshd[2135258]: Disconnected from invalid user elsearch 198.98.56.205 port 54216 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 27 15:18:50 host2 sshd[2136182]: Received disconnect from 198.98.56.205 port 40488:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-12-27 15:19:05 +0530] info [whostmgrd] 158.94.210.79 - RE_Trinco "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:19:38 host2 sshd[2137142]: Disconnected from invalid user asw 93.113.63.124 port 59304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-27 15:21:07 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:54899: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:20:16 host2 sshd[2137786]: Disconnected from invalid user avahi 93.113.63.124 port 57758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.227.3.232
country_id: 3996063
description:
Dec 27 15:20:30 host2 sshd[2137989]: Disconnected from invalid user zimbra 148.227.3.232 port 49342 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-27 15:21:37 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:47774: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2025-12-27 15:21:52 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:51116: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.237.188.150
country_id: 3469034
description:
Dec 27 15:21:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=186.237.188.150, lip=66.85.158.91, TLS, session=<S9GW9OtGhqe67byW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-27 15:21:23 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:41716: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.107
country_id: 3469034
description:
Dec 27 15:22:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=168.0.224.107, lip=66.85.158.91, TLS, session=<Pcu99etGqJyoAOBr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Dec 27 15:22:15 host2 sshd[2139375]: Disconnected from invalid user deep 93.113.63.124 port 43380 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.227.3.232
country_id: 3996063
description:
Dec 27 15:25:54 host2 sshd[2142253]: Disconnected from invalid user ghost 148.227.3.232 port 54218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-27 15:26:01 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:55409: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.139.17.117
country_id: 2300660
description:
Dec 27 15:25:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=41.139.17.117, lip=66.85.158.91, TLS, session=<BcVxAOxGXNUpixF1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.81
country_id: 2510769
description:
Dec 27 15:25:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.229.98.81, lip=66.85.158.91, TLS, session=<tZufAexG97i55WJR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-27 15:26:13 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:60473: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-12-27 15:28:26 dovecot_login authenticator failed for H=([82.102.188.117]) [82.102.188.117]:53676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.61
country_id: 1733045
description:
2025-12-27 15:28:43 dovecot_login authenticator failed for H=([49.124.153.61]) [49.124.153.61]:35212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-27 15:29:19 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:5152: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 15:29:32 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:48207: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.161.12
country_id: 6252001
description:
Dec 27 15:29:47 host2 sshd[2145275]: Disconnected from invalid user avahi 143.198.161.12 port 50232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-27 15:30:26 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:49816: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-12-27 15:30:39 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:39636: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 27 15:30:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<tMwOFuxG0pnE+2YU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2025-12-27 15:34:53 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:48490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-12-27 15:35:43 dovecot_login authenticator failed for H=([103.57.184.151]) [103.57.184.151]:41654: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.221
country_id: 2635167
description:
Dec 27 15:36:29 host2 pure-ftpd[2151954]: (?@87.236.176.221) [INFO] New connection from 87.236.176.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 15:42:08 host2 pure-ftpd[2157271]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:45:09 host2 sshd[2160600]: Disconnected from invalid user oneadmin 154.94.232.217 port 52900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:45:21 host2 sshd[2160819]: Disconnected from invalid user steamcmd 161.18.228.75 port 44118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 27 15:45:56 host2 sshd[2161278]: Disconnected from invalid user test 200.69.236.207 port 46168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:46:16 host2 sshd[2161786]: Disconnected from invalid user puppet 161.18.228.75 port 60632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:46:56 host2 sshd[2162518]: Disconnected from invalid user track 161.18.228.75 port 46324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:47:24 host2 sshd[2162945]: Disconnected from invalid user web 154.94.232.217 port 59512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 27 15:47:29 host2 sshd[2163013]: Disconnected from invalid user vasile 200.69.236.207 port 59036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:47:36 host2 sshd[2163105]: Disconnected from invalid user apps 161.18.228.75 port 60234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.18.228.75
country_id: 3686110
description:
Dec 27 15:48:14 host2 sshd[2163571]: Disconnected from invalid user arun 161.18.228.75 port 45918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.94.232.217
country_id: 241170
description:
Dec 27 15:48:39 host2 sshd[2163833]: Disconnected from invalid user duser 154.94.232.217 port 55828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-27 15:49:25 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (sulfacte) [98.203.34.136]:42436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Dec 27 15:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UvqVW+xGdrpChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:50:44 host2 sshd[2165493]: Disconnected from invalid user git 59.97.205.137 port 7750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:52:02 host2 sshd[2166553]: Disconnected from invalid user law 59.97.205.137 port 46478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:51:23 host2 sshd[2166052]: Disconnected from invalid user bull 59.97.205.137 port 46053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec 27 15:52:47 host2 sshd[2167267]: Disconnected from invalid user python 59.97.205.137 port 34189 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-27 15:53:45 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:38704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-27 15:54:25 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:57863: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-27 15:56:35 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:35161: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 27 15:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS, session=<htY+cuxGrI5C8NuS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Dec 27 15:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<2HlCcuxG/o5C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.157
country_id: 2413451
description:
2025-12-27 15:57:06 dovecot_login authenticator failed for H=([197.255.201.157]) [197.255.201.157]:33720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2025-12-27 15:56:11 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:52462: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 27 15:57:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<t+b9c+xGwt7E+2YT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-27 15:58:12 dovecot_login authenticator failed for H=([122.187.222.54]) [122.187.222.54]:47536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-12-27 16:00:52 dovecot_login authenticator failed for H=kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:48294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-27 16:01:14 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:48578: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 16:02:22 host2 sshd[2177106]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.207
country_id: 3469034
description:
Dec 27 16:03:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.7.187.207, lip=66.85.158.91, TLS, session=<78tmiOxGrYctB7vP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.160
country_id: 690791
description:
Dec 27 16:03:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=194.44.140.160, lip=66.85.158.91, TLS, session=<fbmKiexGe8zCLIyg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2025-12-27 16:04:50 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:49217: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.196
country_id: 2510769
description:
2025-12-27 16:05:13 dovecot_login authenticator failed for H=(cli-5b7e28c4.wholesale.adamo.es) [91.126.40.196]:60150: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 27 16:12:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<lmAIqexGYp+nXpI7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.11.106
country_id: 226074
description:
Dec 27 16:16:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.11.106, lip=66.85.158.91, TLS, session=<KOPxt+xGjYHEAAtq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-27 16:17:04 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:39728: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.44.71.228
country_id: 3469034
description:
Dec 27 16:16:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.44.71.228, lip=66.85.158.91, TLS, session=<Ow+gtuxGnqexLEfk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-27 16:17:18 dovecot_login authenticator failed for H=([128.185.101.201]) [122.185.146.18]:53872: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.201.157
country_id: 2413451
description:
2025-12-27 16:22:35 dovecot_login authenticator failed for H=([197.255.201.157]) [197.255.201.157]:55252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-27 16:23:10 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:55383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 16:28:37 host2 sshd[2200011]: Disconnected from invalid user  62.60.131.157 port 39755 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 16:30:22 host2 sshd[2201836]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-27 16:38:12 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:56887: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.77
country_id: 2186224
description:
2025-12-27 16:38:27 dovecot_login authenticator failed for H=([121.73.162.77]) [121.73.162.77]:49572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.144.234
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.50.144.234 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.41.145
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.97.41.145 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.39.223.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 64.39.223.164 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.119.246
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 143.105.119.246 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.67.131.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 64.67.131.25 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.52.159.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.52.159.200 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.48.186.170
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.48.186.170 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.218.27.185
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.218.27.185 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.42.161
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.71.42.161 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.166.213
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.71.166.213 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.89.43.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.89.43.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.219.204
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.221.219.204 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.242.244.194
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.242.244.194 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.51.41.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.51.41.164 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:41:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xKhyEe1GEIMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:42:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<kgLnFu1G/JMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:44:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AX6tHO1GGLYDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 16:44:50 host2 pure-ftpd[2215401]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:45:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<hb9rIe1GoqADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:46:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XspQI+1GbKwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:47:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<w90AKO1GCJwDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 27 16:48:51 host2 pure-ftpd[2218387]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 27 16:49:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<u7DQLe1GKN4DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:50:12 host2 sshd[2219353]: Disconnected from invalid user karen 162.223.91.130 port 57968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:52:40 host2 sshd[2220974]: Disconnected from invalid user deploy 162.223.91.130 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:52:10 host2 sshd[2220629]: Disconnected from invalid user dev 191.185.168.78 port 45544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:52:38 host2 sshd[2220944]: Disconnected from invalid user admin 35.216.63.127 port 40404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:53:12 host2 sshd[2221735]: Disconnected from invalid user ubuntu 162.223.91.130 port 53652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:53:40 host2 sshd[2222467]: Disconnected from invalid user admin 191.185.168.78 port 45080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-27 16:54:11 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:34162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-27 16:54:24 dovecot_login authenticator failed for H=16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:43964: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Dec 27 16:54:39 host2 sshd[2223739]: Disconnected from invalid user admin 162.223.91.130 port 60204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Dec 27 16:56:45 host2 sshd[2225397]: Disconnected from invalid user ubuntu 191.185.168.78 port 44158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:56:48 host2 sshd[2225444]: Disconnected from invalid user rede 35.216.63.127 port 58564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.232
country_id: 2658434
description:
Dec 27 16:58:30 host2 sshd[2226847]: Disconnected from invalid user username 185.196.11.232 port 44842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 27 16:59:26 host2 sshd[2227763]: Disconnected from invalid user rocky 35.216.63.127 port 27964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2025-12-27 16:59:43 dovecot_login authenticator failed for H=([49.124.151.51]) [49.124.151.51]:35430: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-27 16:59:56 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:59460: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Dec 27 17:01:18 host2 sshd[2229457]: Disconnected from invalid user acs 4.194.4.255 port 44490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-27 17:04:03 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:49338: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.194.4.255
country_id: 1880251
description:
Dec 27 17:04:07 host2 sshd[2232072]: Disconnected from invalid user bodega 4.194.4.255 port 51840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-27 17:03:46 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:48620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2025-12-27 17:04:29 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:59876: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:09:47 host2 sshd[2237411]: Disconnected from invalid user admin 110.78.149.220 port 48602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.204
country_id: 2413451
description:
2025-12-27 17:11:54 dovecot_login authenticator failed for H=([197.255.200.204]) [197.255.200.204]:52048: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.44.137.178
country_id: 798549
description:
2025-12-27 17:11:33 dovecot_login authenticator failed for H=([89.44.137.178]) [89.44.137.178]:40594: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:11:37 host2 sshd[2239344]: Disconnected from invalid user git 110.78.149.220 port 60902 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 110.78.149.220
country_id: 1605651
description:
Dec 27 17:13:18 host2 sshd[2240978]: Received disconnect from 110.78.149.220 port 43342:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.227.8.186
country_id: 934292
description:
Dec 27 17:19:25 host2 sshd[2246841]: Disconnected from invalid user control 197.227.8.186 port 57097 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.88.69
country_id: 1605651
description:
Dec 27 17:21:10 host2 sshd[2248637]: Disconnected from invalid user es 49.228.88.69 port 34988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:21:22 host2 sshd[2248817]: Disconnected from invalid user deluge 103.98.176.164 port 34292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-27 17:22:11 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:37663: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-27 17:22:24 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:48424: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:22:38 host2 sshd[2250137]: Disconnected from invalid user yann 103.98.176.164 port 43174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:23:07 host2 sshd[2250594]: Disconnected from invalid user es 20.87.21.241 port 53280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Dec 27 17:23:18 host2 sshd[2250778]: Disconnected from invalid user ftpuser1 103.98.176.164 port 46034 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:23:47 host2 sshd[2251134]: Received disconnect from 104.248.245.89 port 57136:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-27 17:27:15 dovecot_login authenticator failed for H=([115.248.4.85]) [115.248.4.85]:50805: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:27:55 host2 sshd[2254845]: Disconnected from invalid user administrator 20.87.21.241 port 35244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-27 17:28:04 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:51472: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 17:28:12 host2 sshd[2255116]: Disconnected from invalid user marian 62.60.131.157 port 42650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:28:44 host2 sshd[2255678]: Disconnected from invalid user user 20.87.21.241 port 43618 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:28:46 host2 sshd[2255728]: Received disconnect from 104.248.245.89 port 56910:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 17:30:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57174: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:30:07 host2 sshd[2256995]: Disconnected from invalid user user 202.4.106.201 port 48172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 27 17:30:18 host2 sshd[2257218]: Disconnected from invalid user userftp 104.248.245.89 port 52732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 27 17:31:09 host2 sshd[2257935]: Disconnected from invalid user steam 20.87.21.241 port 40600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-27 17:31:33 dovecot_login authenticator failed for H=(160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:34290: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2025-12-27 17:31:44 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:43916: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:32:14 host2 sshd[2258870]: Disconnected from invalid user service 202.4.106.201 port 55068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.55.10
country_id: 1819730
description:
Dec 27 17:34:04 host2 sshd[2260509]: Disconnected from invalid user alice 47.76.55.10 port 39718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 27 17:37:04 host2 sshd[2263464]: Disconnected from invalid user mehrdad 202.4.106.201 port 52338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 27 17:37:11 host2 sshd[2263596]: Disconnected from invalid user user 142.93.27.16 port 58654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 27 17:37:16 host2 sshd[2263635]: Disconnected from invalid user gustavo 101.47.51.24 port 57818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-27 17:37:32 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:59464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-27 17:37:57 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:35545: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Dec 27 17:37:20 host2 sshd[2263732]: Disconnected from invalid user es 144.48.243.18 port 52606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 27 17:38:52 host2 sshd[2265131]: Disconnected from invalid user postgres 142.93.27.16 port 40154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Dec 27 17:41:33 host2 sshd[2267174]: Disconnected from invalid user k 144.48.243.18 port 35060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 27 17:41:47 host2 sshd[2267337]: Disconnected from invalid user test 219.92.8.45 port 40234 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Dec 27 17:41:48 host2 sshd[2267361]: Disconnected from invalid user deploy 139.59.66.39 port 55324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-27 17:44:40 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (trapormis) [24.23.125.83]:46320: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-27 17:44:43 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (rable) [68.82.141.145]:34640: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 17:47:23 host2 sshd[2272016]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:45 host2 sshd[2272194]: Invalid user httpssmtp.zoho.com587hr@lezzarotech.com from 181.117.8.21 port 56659


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:51 host2 pure-ftpd[2272195]: (?@181.117.8.21) [WARNING] Authentication failed for user [httpssmtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.117.8.21
country_id: 3865483
description:
Dec 27 17:47:53 host2 sshd[2272334]: Invalid user httpssmtp.zoho.com587hr from 181.117.8.21 port 57034


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 17:47:18 host2 pure-ftpd[2271972]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 17:57:14 host2 sshd[2280724]: Disconnected from invalid user  62.60.131.157 port 7771 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.221.101.47
country_id: 3469034
description:
Dec 27 17:58:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.221.101.47, lip=66.85.158.91, TLS, session=<3R98I+5GzJCx3WUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Dec 27 17:58:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<5/5HJe5GxuKyMLU6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:05:21 host2 sshd[2287235]: Disconnected from invalid user wangtao 38.137.11.10 port 41784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 27 18:05:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<HJKqPu5GZtW58uIh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:05:57 host2 sshd[2287699]: Disconnected from invalid user sabine 72.240.125.133 port 41654 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:06:51 host2 sshd[2288371]: Disconnected from invalid user anon 38.137.11.10 port 24742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2025-12-27 18:06:41 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:52304: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-27 18:07:10 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:38108: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:07:13 host2 sshd[2288648]: Disconnected from invalid user administrator 72.240.125.133 port 38524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 27 18:07:31 host2 sshd[2288961]: Disconnected from invalid user steve 38.137.11.10 port 8017 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 27 18:08:17 host2 sshd[2289623]: Disconnected from invalid user mis 72.240.125.133 port 33950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:09:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ypRfS+5G9oEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 18:12:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<fl85Vu5GHqenrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 18:12:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<GJegV+5GytguZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 18:13:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<IQpeWu5GGqekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-27 18:14:05 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:48215: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-27 18:14:24 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:38710: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 18:14:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<KJaUYO5G1KovT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 18:15:34 host2 sshd[2296235]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:17:43 host2 sshd[2297845]: Disconnecting authenticating user root 185.164.80.22 port 35696: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:17:43 host2 sshd[2297845]: error: maximum authentication attempts exceeded for root from 185.164.80.22 port 35696 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.164.80.22
country_id: 617790
description:
Dec 27 18:18:02 host2 sshd[2298211]: Disconnecting invalid user admin 185.164.80.22 port 58054: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 18:18:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<MHmVbe5GBsgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2025-12-27 18:19:42 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:21257: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 18:19:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<gb66ce5GCIkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 18:19:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<fat9cu5G8MZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.225.217.145
country_id: 3469034
description:
Dec 27 18:19:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=186.225.217.145, lip=66.85.158.91, TLS, session=<6jZ7ce5GgoS64dmR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-27 18:20:05 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:36558: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 18:20:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0mYhc+5GLKxV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.164
country_id: 3175395
description:
Dec 27 18:20:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=185.15.171.164, lip=66.85.158.91, TLS, session=<tLSdcu5GAYe5D6uk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 18:21:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<3BE5d+5GOjOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 18:23:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<I0dMfe5GGl9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 18:23:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<K22xfe5GsoSnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 18:23:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<eeJ7f+5GXM6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 18:24:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VjMog+5GqIsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 18:24:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EOqOg+5G6tKnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-27 18:24:19 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:59352: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 18:25:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<AQXshO5G4NWElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 18:25:38 host2 sshd[2305523]: Disconnected from invalid user  62.60.131.157 port 63328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec 27 18:25:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<hdUPh+5GdoNAF4KF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 27 18:28:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<oDCCj+5GSNO58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 18:28:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8uTZke5GcuYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-27 18:29:39 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:37984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-27 18:29:56 dovecot_login authenticator failed for H=(cm-178.232.220.147.get.no) [178.232.220.147]:36759: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 18:31:47 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (noctie) [89.25.223.210]:57590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-27 18:31:51 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (blecitted) [73.208.81.125]:41254: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:32:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fdjyne5GOK8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 18:36:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<vxwqrO5G0pLBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 18:36:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</Xbzru5GQsql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 18:38:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yzEps+5GPuYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.211.84
country_id: 933860
description:
Dec 27 18:37:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.216.211.84, lip=66.85.158.91, TLS, session=<lkRDsO5Gd6Ip2NNU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.217
country_id: 2215636
description:
Dec 27 18:37:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=169.239.118.217, lip=66.85.158.91, TLS, session=<du6Yse5Gmtap73bZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 18:37:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<LE+fsu5GStEv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.151.98.114
country_id: 6252001
description:
Dec 27 18:39:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=57.151.98.114, lip=66.85.158.91, session=<jbQ0ue5GMKA5l2Jy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 18:41:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bOfDve5G8E4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 18:41:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<W+epve5GDChniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 27 18:41:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3MdLwO5GbIkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 18:42:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<t+bywu5GUOTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 27 18:43:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<s/HBx+5GBrkFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.134.45
country_id: 1819730
description:
Dec 27 18:43:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.134.45, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hD89yO5GcDWYIIYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 18:44:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NVVHye5Gau1A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 27 18:47:19 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<XJBh1O5GANq58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 18:47:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<YhbM1O5G4tkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 18:48:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cckr2e5GtM9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 18:49:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oHG+2u5GLr4v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 18:50:12 host2 pure-ftpd[2328518]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 197.234.202.52
country_id: 953987
description:
Dec 27 18:50:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=197.234.202.52, lip=66.85.158.91, TLS, session=<TADP3u5GpsHF6so0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.78
country_id: 798544
description:
Dec 27 18:50:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=77.65.142.78, lip=66.85.158.91, TLS, session=<y4Ym4O5GghJNQY5O>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 27 18:51:14 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<PARd4u5G3py58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.248.67
country_id: 1269750
description:
2025-12-27 18:51:44 dovecot_login authenticator failed for H=([122.187.248.67]) [122.187.248.67]:40700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 18:51:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<iLeu5O5G8sIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 18:52:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sd8g5e5Gdohnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-27 18:52:29 dovecot_login authenticator failed for H=24-119-144-86.cpe.sparklight.net [24.119.144.86]:49140: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.52.114
country_id: 1269750
description:
2025-12-27 18:52:45 dovecot_login authenticator failed for H=([122.187.223.255]) [182.79.52.114]:33540: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 18:53:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<2yfo6e5G2OKnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 27 18:56:29 host2 sshd[2334953]: Disconnected from invalid user rapid 115.85.80.12 port 34454 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 27 18:57:16 host2 sshd[2335603]: Disconnected from invalid user blog 115.85.80.12 port 59906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 27 18:58:10 host2 sshd[2336362]: Disconnected from invalid user alfresco 151.49.129.67 port 50820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 27 18:59:15 host2 sshd[2337607]: Disconnected from invalid user john 151.49.129.67 port 57708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-27 18:59:29 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:43357: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.191
country_id: 6252001
description:
Dec 27 18:59:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.191, lip=66.85.158.92, session=<KmjU/u5GwMYUqwi/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-12-27 18:59:12 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:56104: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 18:59:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<o+il/u5GyIAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-27 19:00:48 dovecot_plain authenticator failed for H=(proff) [65.20.233.110]:36804: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:02:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<r1tRCu9GjtSnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.245.122.12
country_id: 6252001
description:
Dec 27 19:02:29 host2 pure-ftpd[2341132]: (?@157.245.122.12) [INFO] New connection from 157.245.122.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Dec 27 19:02:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<RYb2Cu9GrukI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 19:03:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<PP3yDO9G3uUuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 19:05:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<LyBWFe9G3tmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 19:06:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<8TOBGe9G4L5hSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-27 19:09:16 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 19:09:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<udZ3I+9G7rgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 19:11:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<dgKPKu9G9LRo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 27 19:13:50 host2 sshd[2353636]: Disconnected from invalid user cristian 213.6.203.226 port 33443 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.112.22
country_id: 3017382
description:
2025-12-27 19:13:46 dovecot_login authenticator failed for H=([188.231.112.22]) [188.231.112.22]:58084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-27 19:14:09 dovecot_login authenticator failed for H=([92.47.46.174]) [92.47.46.174]:60216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-27 19:14:22 dovecot_plain authenticator failed for H=(nonlitid) [105.72.176.66]:40086: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 19:14:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<7XoeNe9GQMmi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 27 19:14:27 host2 sshd[2354264]: Disconnected from invalid user lukas 213.6.203.226 port 50140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 19:14:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<wRViNe9GuNBV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 19:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</mGoOu9GeMuElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 19:16:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<tczoOu9GnMenrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 19:15:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<8/ADOO9GMO6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:15:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Oi/jOe9GqLanrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 19:16:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IIecPe9Gen8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 19:18:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<6D6NRO9G4dt100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 27 19:18:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.91, session=<w8OnQ+9GYOpQUk3K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 19:21:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Y7+6TO9G+pAv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 19:21:58 host2 sshd[2362021]: Disconnected from invalid user  62.60.131.157 port 44659 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 19:23:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<CBQfVO9GpJ0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 27 19:28:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<sFkvZ+9GlMTJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 19:30:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<f+uNbu9GisUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 19:30:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5qsTcO9GTJSl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-27 19:31:09 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:9106: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 19:31:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uknCcu9GaMIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-27 19:32:05 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:40458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 19:32:54 host2 sshd[2372470]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 19:33:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EdVaeO9GvlgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 19:34:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<e3bBfO9GhN3Bl4nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec 27 19:34:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<r3Fhfu9GekKnXpI8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 27 19:34:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mNxwfO9GWugFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 27 19:35:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jX3BgO9GgItChJl5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 19:36:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QPWdg+9GeA5niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 27 19:37:08 host2 sshd[2375881]: Disconnected from invalid user mc 163.44.173.168 port 36378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 19:37:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<mGHAh+9G1IhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 19:38:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ryHajO9G/uQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:39:21 host2 sshd[2377582]: Disconnected from invalid user mam 200.118.99.170 port 51464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Dec 27 19:39:22 host2 sshd[2377588]: Disconnected from invalid user ict 41.59.86.232 port 37968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 19:41:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<46iklO9GhIfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 19:40:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cOPOku9GWtsv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 27 19:41:24 host2 sshd[2379402]: Disconnected from invalid user mam 163.44.173.168 port 49264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 19:41:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ARq2l+9GsMhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.200.231.148
country_id: 1269750
description:
2025-12-27 19:42:11 dovecot_login authenticator failed for H=([117.200.231.148]) [117.200.231.148]:42095: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-27 19:42:24 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:57896: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Dec 27 19:42:50 host2 sshd[2380396]: Disconnected from invalid user alejandro 41.59.86.232 port 53782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:43:34 host2 sshd[2381184]: Disconnected from invalid user root1 200.118.99.170 port 50682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 19:43:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<qfABnu9GMJUvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 27 19:44:10 host2 sshd[2381789]: Disconnected from invalid user ansible 200.118.99.170 port 34440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 19:45:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OzxPpe9GJOZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 19:46:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<+zFGqO9GFiCnYwhf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.233.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.158.233.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.171.128
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.48.171.128 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.120.50.151
country_id: 6252001
description:
[2025-12-27 19:47:17 +0530] info [cpaneld] 69.120.50.151 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.44.224.102
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.44.224.102 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.121.217
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.4.121.217 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.107.23.106
country_id: 6252001
description:
[2025-12-27 19:47:18 +0530] info [cpaneld] 68.107.23.106 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.137.139
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.244.137.139 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.12.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.72.12.16 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.155.183
country_id: 6252001
description:
[2025-12-27 19:47:19 +0530] info [cpaneld] 97.170.155.183 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.166.75.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.166.75.247 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.251.161.241
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.251.161.241 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.114.128.106
country_id: 6252001
description:
[2025-12-27 19:47:22 +0530] info [cpaneld] 99.114.128.106 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.30.184.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 38.30.184.21 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.54.85.18
country_id: 6252001
description:
[2025-12-27 19:47:21 +0530] info [cpaneld] 104.54.85.18 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.204.244
country_id: 2413451
description:
2025-12-27 19:47:50 dovecot_login authenticator failed for H=(197-255-204-244.netpagedns.net) [197.255.204.244]:34157: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-27 19:48:09 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:59028: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.227.244
country_id: 1269750
description:
Dec 27 19:48:19 host2 sshd[2386169]: Disconnected from invalid user soporte 103.123.227.244 port 37992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Dec 27 19:48:23 host2 sshd[2386205]: Disconnected from invalid user steam 202.184.153.250 port 59922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 19:50:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0/cWte9GrpIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-27 19:53:34 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:36355: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-12-27 19:53:51 dovecot_login authenticator failed for H=([49.124.151.82]) [49.124.151.82]:45468: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 19:54:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<BirSwu9GVtWnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 19:53:30 host2 pure-ftpd[2390666]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 19:54:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<aUOQxe9GkI0uZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 19:58:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AOtJ0u9GKJGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 20:00:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<a5pg2u9GdKQyBsPO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 20:01:15 host2 sshd[2397680]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:02:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<eTVZ4e9GjNUjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:04:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<z6Xj5u9GMuQjy9Kr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:04:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<bU2J5+9GgOkjy9Kr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 20:04:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<f3/h5+9GKPRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 20:06:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<0GmT7e9GgohhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2025-12-27 20:06:14 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:36902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:06:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nDBB7+9GHtQv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-27 20:06:41 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:35341: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 20:06:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<Ljkm8e9GOMGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 20:07:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<XZ078e9Gmoui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:07:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<XcAn8u9GCoenrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-12-27 20:07:30 dovecot_login authenticator failed for H=(host-129.0.111.246.mtn.cm) [129.0.111.246]:52691: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 20:07:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<QHDa8+9Gfimi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-27 20:07:58 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:44696: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:08:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4zQE9u9Gpt0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 20:09:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<vwJq+e9GnJZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 20:09:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uGaw+u9GUskvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-27 20:09:41 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:43339: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2025-12-27 20:10:01 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:40850: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 20:11:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<+3oIAPBG9q+nrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.171
country_id: 2635167
description:
Dec 27 20:10:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.171, lip=66.85.158.92, TLS, session=<ECSR/+9GYvQjy9Kr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 20:13:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7DzBBvBGzJUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 20:14:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bMdmCvBG2pIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 20:15:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<WhzfDfBGE89100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.112.243
country_id: 3865483
description:
Dec 27 20:20:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.110.112.243, lip=66.85.158.91, TLS, session=<orqnIfBGNOu+bnDz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.63
country_id: 3057568
description:
Dec 27 20:21:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=91.226.115.63, lip=66.85.158.91, TLS, session=<gUjWIvBG2uJb4nM/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 20:22:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<o7nZKfBGvqQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.37
country_id: 933860
description:
Dec 27 20:24:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.209.37, lip=66.85.158.91, TLS, session=<6r3sL/BG4t0p2NEl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 20:24:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0BiKMfBGwt+l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.120.72.124
country_id: 3469034
description:
Dec 27 20:24:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.120.72.124, lip=66.85.158.91, TLS, session=<qj6nLvBGOsi7eEh8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:24:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2KiQMPBGfq0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:24:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NxmeMPBGBHIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 204.76.203.87
country_id: 2750405
description:
Dec 27 20:25:31 host2 pure-ftpd[2418870]: (?@204.76.203.87) [INFO] New connection from 204.76.203.87


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.24.237.152
country_id: 130758
description:
Dec 27 20:26:29 host2 pure-ftpd[2420188]: (?@195.24.237.152) [INFO] New connection from 195.24.237.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-12-27 20:28:54 dovecot_login authenticator failed for H=([103.194.243.187]) [103.194.243.187]:53362: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 20:29:13 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:52804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-27 20:29:31 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 20:29:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<XMhqQ/BG8JEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 20:31:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ti4nR/BGfTlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 20:31:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qKsbR/BGLtdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 20:31:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<EF9CSfBGgr8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 20:32:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Q6lCTfBGHqLBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec 27 20:33:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<GvnAUPBGxqlAF4KF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 204.76.203.87
country_id: 2750405
description:
Dec 27 20:34:16 host2 pure-ftpd[2426845]: (?@204.76.203.87) [INFO] New connection from 204.76.203.87


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 20:35:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=</wKrVvBGMNUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 20:35:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ZmNuV/BGMIpA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 27 20:36:45 host2 sshd[2429501]: Invalid user secondcoffeeinternational from 41.203.222.206 port 17692


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-27 20:37:08 dovecot_login authenticator failed for H=(186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:43959: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.67.117
country_id: 1269750
description:
2025-12-27 20:37:39 dovecot_login authenticator failed for H=([103.58.67.117]) [103.58.67.117]:48277: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 20:39:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<mZxTZPBGNCOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 20:39:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<lvzbZPBGjt7D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 20:39:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lcorZfBGDKZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 20:41:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<rFrcavBG2qYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-27 20:41:15 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:39218: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-27 20:41:31 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:47368: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 20:44:19 host2 sshd[2436034]: Disconnected from invalid user  62.60.131.157 port 24575 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:45:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EDoUfPBGULenrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 20:46:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<yRjGfPBGwKMuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.233
country_id: 6252001
description:
Dec 27 20:46:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.233, lip=66.85.158.91, session=<TRXxfPBGE9domDTp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-27 20:47:13 dovecot_login authenticator failed for H=([201.173.92.229]) [201.173.92.229]:54150: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-27 20:47:31 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:36037: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Dec 27 20:48:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<N6lphfBGGPNBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 20:50:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uprkjPBGVsGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 20:51:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2ssPkfBGVJMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 20:55:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<lFA8oPBGUGho7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.175.205.71
country_id: 1605651
description:
2025-12-27 20:56:33 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.175.205.71]:59486: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 20:56:44 host2 pure-ftpd[2448728]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-27 20:56:53 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:41129: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 20:57:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<l0LUpvBG4raElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 20:57:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Fho8pvBGnK2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 20:58:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<wTCwqfBG5Lwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 20:59:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<88hWq/BGgpqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 20:59:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<E9ubrfBGLlIjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 21:01:04 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56563: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 21:01:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<D40Bs/BGYESi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 21:04:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<+yE5vfBG1sUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 21:04:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<jsUnvfBGhIUzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.213.140
country_id: 2921044
description:
[2025-12-27 21:04:31 +0530] info [cpaneld] 185.216.213.140 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 21:04:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<HUYsv/BGyLVV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 21:04:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<9q3pv/BGoumnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 21:05:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<LTgHwvBGRMVhSlS6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:07:00 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.158, lip=66.85.158.91, session=<P7Pzx/BGuKqlmnee>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=165.154.119.158, lip=66.85.158.91, session=<+7wPyfBGvKqlmnee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 21:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<xvznyPBGur0vT1jH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.219.203
country_id: 6252001
description:
Dec 27 21:08:52 host2 pure-ftpd[2459166]: (?@157.230.219.203) [INFO] New connection from 157.230.219.203


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.158
country_id: 1605651
description:
Dec 27 21:10:10 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.158, lip=66.85.158.92, session=<JrQ90/BGGMylmnee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 21:10:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<sLjp1PBGgfd100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-27 21:14:44 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:37026: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 21:14:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q93M4vBGRIMv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2025-12-27 21:15:12 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:52188: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 21:15:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DgzI5/BG0F8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 21:16:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2aVO6fBG/Jkv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 21:18:43 host2 sshd[2467024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 21:18:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<HXEh8fBGhtml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 21:20:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dfbi9vBG1o0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.104
country_id: 3865483
description:
Dec 27 21:20:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.238.107.104, lip=66.85.158.91, TLS, session=<k6i09/BGCqYt7mto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.105.233
country_id: 3469034
description:
Dec 27 21:21:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=187.85.105.233, lip=66.85.158.91, TLS, session=<AOX9+PBGPpK7VWnp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 21:21:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pQ7R/PBG9LYv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.221.138.185
country_id: 690791
description:
Dec 27 21:24:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=37.221.138.185, lip=66.85.158.91, TLS, session=<ETyXBPFGp7wl3Yq5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 21:24:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<4n/aBfFGftRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.90
country_id: 3057568
description:
Dec 27 21:24:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.226.115.90, lip=66.85.158.91, TLS, session=<CB3HBfFG3rhb4nNa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 21:25:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jDRjC/FGNB5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-27 21:25:57 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:43888: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.204.244
country_id: 2413451
description:
2025-12-27 21:26:21 dovecot_login authenticator failed for H=(197-255-204-244.netpagedns.net) [197.255.204.244]:44793: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 21:26:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Dfd7DfFGhqYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 21:28:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<UDMdFvFG3KNA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-27 21:29:09 dovecot_login authenticator failed for H=([189.109.48.81]) [189.56.202.86]:54193: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-27 21:29:25 dovecot_login authenticator failed for H=(cm-178.232.209.84.get.no) [178.232.209.84]:54104: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.120.238.231
country_id: 1605651
description:
2025-12-27 21:29:36 dovecot_login authenticator failed for H=ppp-124-120-238-231.revip2.asianet.co.th [124.120.238.231]:40980: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-27 21:29:45 dovecot_login authenticator failed for H=16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:55944: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 21:30:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NL3hGvFG+iunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 21:31:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Rr+1HfFGiM4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 21:31:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<8/RaHvFGdqDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 21:32:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qxJjI/FGVqtnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-27 21:33:51 +0530] info [cpaneld] 38.35.225.197 - euroentertainmen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 21:37:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<W8ppM/FGoJrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 21:36:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<ytPNMPFGiqYuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 21:37:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<1+J6NvFG+KynrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 21:42:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ArFqRvFGDKKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 21:42:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<L7TIRvFGbqoyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-27 21:44:11 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:54099: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-27 21:44:25 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:56550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 21:47:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ntgAV/FGtEZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 21:47:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<QWrxWfFGGq6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.210
country_id: 2658434
description:
Dec 27 21:48:45 host2 sshd[2493571]: Disconnected from invalid user nikola 185.196.11.210 port 33980 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.48.59
country_id: 6252001
description:
Dec 27 21:49:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.48.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VhWbXvFGxrsUqTA7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 21:49:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<8kwJX/FGeqyElEgp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.74.172.237
country_id: 49518
description:
Dec 27 21:50:03 host2 sshd[2495164]: Disconnected from invalid user oracle 41.74.172.237 port 53118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 21:50:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7STHYvFGaKgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 21:50:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<FFwQZPFGOEcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.173
country_id: 2921044
description:
Dec 27 21:51:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.134.173, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<ypofaPFG5/Gl44at>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 21:51:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<W0QAZvFGjMunrKy4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.172.172.184
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.172.172.184] [Remote Port]=[52108] [Authentication Database]=[mail] [Username]=[postfix@bostonlanka.com] (10/10 failures) (blocked until [Sun Dec 28 16:21:13 2025 UTC/Sun Dec 28 21:51:13 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.74.172.237
country_id: 49518
description:
Dec 27 21:52:12 host2 sshd[2502795]: Disconnected from invalid user ubuntu 41.74.172.237 port 49256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.221.50
country_id: 2921044
description:
Dec 27 21:52:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=207.154.221.50, lip=66.85.158.92, TLS handshaking: Connection closed, session=<deBCavFGPDvPmt0y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 21:54:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<70gJcPFGaKczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-27 21:53:20 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:39518: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[42856] [Authentication Database]=[mail] [Username]=[webmaster@dataesite.lk] (10/10 failures) (blocked until [Sun Dec 28 16:24:01 2025 UTC/Sun Dec 28 21:54:01 2025 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 21:54:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<iqS1cvFG+smi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 21:55:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<OpYNdPFG/o0v/lVz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 21:56:20 host2 sshd[2512518]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 27 21:56:22 host2 sshd[2512522]: Disconnected from invalid user office 103.191.14.210 port 53568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 27 21:56:39 host2 sshd[2512685]: Disconnected from invalid user ali 12.189.234.28 port 35601 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.210
country_id: 2658434
description:
Dec 27 21:58:11 host2 sshd[2513973]: Disconnected from invalid user bitrix 185.196.11.210 port 42332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 27 21:58:35 host2 sshd[2514217]: Disconnected from invalid user mark 12.189.234.28 port 51480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.210
country_id: 2658434
description:
Dec 27 21:58:41 host2 sshd[2514275]: Disconnected from invalid user db2admin 185.196.11.210 port 59542 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.196.11.210
country_id: 2658434
description:
Dec 27 21:58:41 host2 sshd[2514275]: Received disconnect from 185.196.11.210 port 59542:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 21:59:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<CiX6gfFGUL+nrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.210
country_id: 2658434
description:
Dec 27 21:59:10 host2 sshd[2514592]: Disconnected from invalid user ubuntu 185.196.11.210 port 57266 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 21:59:58 host2 pure-ftpd[2515074]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 27 22:00:06 host2 sshd[2515359]: Disconnected from invalid user ccorrea 12.189.234.28 port 40231 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 27 22:00:07 host2 sshd[2515371]: Disconnected from invalid user croceiris 103.191.14.210 port 59386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 27 22:01:03 host2 sshd[2516038]: Disconnected from invalid user production 12.189.234.28 port 51560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 22:00:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<+Vy+h/FGNr5V6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-27 22:01:56 dovecot_login authenticator failed for H=([182.95.26.55]) [182.95.185.170]:49452: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-27 22:01:21 dovecot_login authenticator failed for H=h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:50220: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 27 22:01:27 host2 sshd[2516286]: Disconnected from invalid user francois 103.191.14.210 port 44928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 22:04:04 host2 sshd[2518200]: Disconnected from invalid user  62.60.131.157 port 37614 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 22:04:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<9ZSNlPFGyqphSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 27 22:04:24 host2 sshd[2518374]: Disconnected from invalid user develop 103.191.14.210 port 60474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 22:04:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<0DwYl/FGkpAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.145.142.243
country_id: 1269750
description:
Dec 27 22:06:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<washeera@lezzarotech.com>, method=PLAIN, rip=203.145.142.243, lip=66.85.158.91, TLS, session=<iGfJmfFGNrXLkY7z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 22:05:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<o7QTmvFGqbN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 22:06:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fYlmnfFGNoEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 166.169.118.206
country_id: 6252001
description:
Dec 27 22:06:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<washeera>, method=PLAIN, rip=166.169.118.206, lip=66.85.158.91, TLS, session=<iPicnPFGUSimqXbO>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[33078] [Authentication Database]=[mail] [Username]=[admin@melanifinefood.com] (10/10 failures) (blocked until [Sun Dec 28 16:36:42 2025 UTC/Sun Dec 28 22:06:42 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 22:06:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<YMksnvFGnNAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 27 22:07:40 host2 sshd[2521171]: Disconnected from invalid user mark 45.182.207.45 port 58028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 22:08:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<qvTUovFGOoEv7PP+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.236.243.254
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.236.243.254] [Remote Port]=[33082] [Authentication Database]=[mail] [Username]=[hr@melanifinefood.com] (10/10 failures) (blocked until [Sun Dec 28 16:38:13 2025 UTC/Sun Dec 28 22:08:13 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 22:12:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<HKABsfFG1tGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 22:12:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5giysvFG2Kwv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[44248] [Authentication Database]=[mail] [Username]=[admin@dataesite.lk] (10/10 failures) (blocked until [Sun Dec 28 16:42:39 2025 UTC/Sun Dec 28 22:12:39 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 27 22:12:45 host2 sshd[2525114]: Disconnected from invalid user test 45.182.207.45 port 38336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 27 22:15:06 host2 sshd[2527681]: Disconnected from invalid user hamed 45.182.207.45 port 50674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 22:17:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<B/Alw/FGAqxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 22:18:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<DLOiyPFGAugvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 22:20:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<VKUmz/FGBMmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 22:20:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<wm1Yz/FGjOYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 22:20:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Te+VzvFG+0pniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.178
country_id: 953987
description:
Dec 27 22:20:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=102.64.40.178, lip=66.85.158.91, TLS, session=<lnIMzvFG16FmQCiy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.97
country_id: 2635167
description:
Dec 27 22:21:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.97, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Fbw+0fFGFdIjy9Nh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 22:21:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uQof0/FGkulA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.46
country_id: 953987
description:
Dec 27 22:20:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=102.64.32.46, lip=66.85.158.91, TLS, session=<hNJZz/FGBcdmQCAu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.97
country_id: 2635167
description:
Dec 27 22:22:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.97, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<pKrS1PFGHPojy9Nh>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.136.122
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.136.122] [Remote Port]=[59794] [Authentication Database]=[mail] [Username]=[contact@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Dec 28 16:51:43 2025 UTC/Sun Dec 28 22:21:43 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-27 22:23:17 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:49586: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 22:24:34 host2 sshd[2534573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.64.40.209
country_id: 953987
description:
Dec 27 22:24:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=102.64.40.209, lip=66.85.158.91, TLS, session=<DIgU2/FGJKBmQCjR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.240
country_id: 3175395
description:
Dec 27 22:24:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.15.170.240, lip=66.85.158.91, TLS, session=<6ZhM3PFGtrO5D6rw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-27 22:23:49 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:55177: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 22:25:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dyjV3/FGLqBnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.229.219.177
country_id: 6252001
description:
Dec 27 22:25:21 host2 pure-ftpd[2535302]: (?@34.229.219.177) [INFO] New connection from 34.229.219.177


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 22:26:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<VOI05fFGoLIuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.97
country_id: 2635167
description:
Dec 27 22:29:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.97, lip=66.85.158.91, TLS, session=<IPi97fFG6PQjy9Nh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 22:29:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<LMDx7vFGIOLBl4nP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 27 22:29:00 host2 sshd[2540615]: Disconnected from invalid user ubuntu 103.172.154.255 port 39484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 22:30:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<sy5d8fFGWr+nrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 27 22:32:09 host2 sshd[2548335]: Disconnected from invalid user testftp 103.172.154.255 port 34964 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 27 22:33:05 host2 sshd[2550460]: Received disconnect from 103.172.154.255 port 38838:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 22:33:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hH7U+/FGvusyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 22:34:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<dkgfAPJG/OvD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-27 22:34:45 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51936: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 22:35:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<5FneAvJGRtGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Dec 27 22:35:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<se11AvJG7uNAF4KF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-27 22:35:01 dovecot_login authenticator failed for H=([102.53.15.18]) [102.53.15.18]:53826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 22:37:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3/iTDPJGsu2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 22:39:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<DmZGEvJG9EZo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-27 22:39:43 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:55036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-27 22:40:44 dovecot_login authenticator failed for H=([122.185.152.199]) [182.95.178.158]:59430: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-27 22:40:24 dovecot_login authenticator failed for H=([122.160.142.194]) [117.247.239.202]:40228: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 22:41:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<winyGPJGUKQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-27 22:42:06 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:47815: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-27 22:42:20 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:47409: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 22:42:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3W1PHfJG3JEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 22:41:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<ZRdsG/JG1qGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 22:43:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<emzRIfJG7oKnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2025-12-27 22:42:56 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:35158: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 27 22:43:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.91, session=<PrdfH/JGaPHY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.229
country_id: 6252001
description:
Dec 27 22:43:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.229, lip=66.85.158.91, TLS handshaking: Connection closed, session=<D//dH/JGMXRBMQHl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 27 22:43:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9sjsIPJGfA1BMQHe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-27 22:43:48 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:52071: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 22:43:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<9N5aIvJGFKYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-27 22:45:22 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:47914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-27 22:46:01 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:4886: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 22:47:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<4sVRLvJGppgv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 22:47:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Yx1BL/JGisKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 22:52:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<U4jSQvJG6MynrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Dec 27 22:53:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<Nqs5Q/JGiqMtT7Xf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.82
country_id: 6252001
description:
Dec 27 22:55:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.82, lip=66.85.158.92, session=<F8ZqS/JG+dxAPpxS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 27 22:55:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS: Connection closed, session=<KL4HTPJGiM1APpxQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 22:55:40 host2 sshd[2585460]: Disconnected from invalid user roderick 62.60.131.157 port 29874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Dec 27 22:56:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<yqZOUPJGVJys7ORv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 22:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<hXVdT/JGpqpV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 22:57:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Q7yLUvJGIEIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.26
country_id: 6252001
description:
Dec 27 22:59:59 host2 pure-ftpd[2589492]: (?@198.235.24.26) [INFO] New connection from 198.235.24.26


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 23:00:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<KWuyXPJGXrEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 23:00:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<v6GGXfJGftkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 23:01:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<IS0RYPJG3+5100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.111
country_id: 6252001
description:
Dec 27 23:01:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<h52WYfJGTI0tT89v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Dec 27 23:01:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.172.21, lip=66.85.158.92, TLS, session=<4ej4YfJGvh0tT6wV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 27 23:02:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<ziqPZfJGepthSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 23:02:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<exroY/JGdoQv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 23:02:46 host2 pure-ftpd[2592444]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 27 23:02:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<NLt+ZvJGGJsvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 23:03:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Ll/aafJG2LMv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 23:06:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mz6IcfJG2o6l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 27 23:08:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<IWpZe/JG6p3UZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 27 23:08:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<WUVee/JG2vrUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.164.159
country_id: 3144096
description:
2025-12-27 23:10:30 dovecot_login authenticator failed for H=([62.97.164.159]) [62.97.164.159]:40750: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 23:10:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<GLBTgvJGQrozTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-27 23:10:52 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:54408: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 27 23:11:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Dy1yhfJGZAWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 27 23:11:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<f/GahfJG8rsvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-27 23:12:33 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:47908: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.155
country_id: 6252001
description:
Dec 27 23:12:37 host2 pure-ftpd[2603727]: (?@205.210.31.155) [INFO] New connection from 205.210.31.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 23:12:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<zJsjivJGTMpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-27 23:13:39 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:57530: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.224.207
country_id: 6252001
description:
Dec 27 23:13:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.15.224.207, lip=66.85.158.91, TLS, session=<4653jfJGNNEUD+DP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 27 23:15:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ifgmkvJGxQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 27 23:17:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wpBCmvJGOOtA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-27 23:17:37 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:33800: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 27 23:17:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<y7pNm/JGKOhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 27 23:17:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<cCFqm/JGKskuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.123.44
country_id: 2921044
description:
Dec 27 23:17:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.226.123.44, lip=66.85.158.92, session=<AYWdm/JG/RtA4nss>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.166.146
country_id: 2921044
description:
Dec 27 23:17:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.166.146, lip=66.85.158.92, session=<mNWom/JG/lSl46aS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.218
country_id: 690791
description:
Dec 27 23:20:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=37.221.147.218, lip=66.85.158.91, TLS, session=<5r+UpPJGh7Ml3ZPa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-27 23:21:09 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:35837: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.99.154
country_id: 3865483
description:
Dec 27 23:20:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=143.202.99.154, lip=66.85.158.91, TLS, session=</9bGpfJGv86PymOa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-27 23:20:58 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:48922: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 23:23:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<IlyFrvJGVoWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-27 23:23:34 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:46453: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 27 23:24:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<KjeYsvJGVIoyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2025-12-27 23:24:14 dovecot_login authenticator failed for H=([122.187.229.151]) [122.187.229.151]:57566: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.228.33.139
country_id: 798544
description:
Dec 27 23:24:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=91.228.33.139, lip=66.85.158.91, TLS, session=<OAJcsvJGnQtb5CGL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.0.251.241
country_id: 3469034
description:
Dec 27 23:24:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=170.0.251.241, lip=66.85.158.91, TLS, session=<e4uMs/JG04uqAPvx>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.53.197
country_id: 2802361
description:
Dec 27 23:27:40 host2 pure-ftpd[2618125]: (?@130.211.53.197) [INFO] New connection from 130.211.53.197


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 27 23:28:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<UXaVwPJGbKrBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 27 23:28:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<nOHCwPJG5JmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 27 23:27:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Bvu/v/JGzNmi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.212.41.221
country_id: 6252001
description:
Dec 27 23:28:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=54.212.41.221, lip=66.85.158.92, TLS: Connection closed, session=<Zfhdw/JG+NA21Cnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 27 23:30:45 host2 sshd[2620712]: Disconnected from invalid user user11 200.155.38.219 port 28699 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-27 23:31:15 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:50913: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 27 23:31:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<r14dzfJGisTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 27 23:31:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<tZDTzfJGSjxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 23:32:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jb4cz/JGWt8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 27 23:34:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<njSM1fJGrukzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 23:34:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<r3vj1/JGEugv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 27 23:35:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=</Yo12vJGyoKElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 27 23:36:54 host2 sshd[2626771]: Disconnected from invalid user team06 200.155.38.219 port 26175 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 27 23:36:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<DKUl4PJGtsOnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 27 23:37:37 host2 sshd[2627425]: Disconnected from invalid user radix 200.155.38.219 port 23172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Dec 27 23:39:06 host2 sshd[2628451]: Disconnected from invalid user team06 45.78.226.12 port 55776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 27 23:39:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<x0y36PJGFKYv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-27 23:39:54 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:45950: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 27 23:40:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2anz6/JGJM+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.109.23
country_id: 1512440
description:
2025-12-27 23:40:24 dovecot_login authenticator failed for H=([213.230.109.23]) [213.230.109.23]:52128: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 23:41:26 host2 sshd[2630361]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-27 23:40:50 dovecot_login authenticator failed for H=(30-170-97-62.cust.smartcall.no) [62.97.170.30]:55588: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 27 23:41:23 host2 sshd[2630313]: Disconnected from invalid user geoserver 200.155.38.219 port 38953 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-27 23:41:27 dovecot_login authenticator failed for H=([125.23.203.114]) [125.23.203.114]:47212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.12
country_id: 1880251
description:
Dec 27 23:43:35 host2 sshd[2631824]: Disconnected from invalid user shiny 45.78.226.12 port 42702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 27 23:46:28 host2 sshd[2634761]: Disconnected from invalid user  62.60.131.157 port 16632 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 27 23:46:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3J0xAvNGduynrEV8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-27 23:47:11 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:58323: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-27 23:47:42 dovecot_login authenticator failed for H=([2.55.88.51]) [2.55.88.51]:53579: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 27 23:48:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1WBICfNGiqsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 27 23:50:54 host2 sshd[2638042]: Disconnected from invalid user payam 152.32.155.11 port 58246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 27 23:52:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<RzbmF/NGsqFV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 27 23:52:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3lEQGPNGFsEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 23:53:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BOLmG/NGppYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 27 23:54:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rWcKHfNGXJIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 27 23:55:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lq7eIfNGNLYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 27 23:56:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<WVqxJfNGmlJ100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-27 23:57:09 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:36434: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-27 23:57:36 dovecot_login authenticator failed for H=(189.218.82.49-clientes-izzi.mx) [189.218.82.49]:58398: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 27 23:57:52 host2 sshd[2643897]: Disconnected from invalid user oracle 152.32.155.11 port 51470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 27 23:58:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=<LLSnLPNG3KPJvgxi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.12
country_id: 798549
description:
Dec 27 23:59:23 host2 pure-ftpd[2644974]: (?@212.73.148.12) [INFO] New connection from 212.73.148.12


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 212.73.148.12
country_id: 798549
description:
Dec 27 23:59:45 host2 pure-ftpd[2645178]: (?@212.73.148.12) [INFO] New connection from 212.73.148.12


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Dec 27 23:59:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bSzlMfNG+itBMQFs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.12
country_id: 798549
description:
Dec 27 23:59:48 host2 pure-ftpd[2645221]: (?@212.73.148.12) [INFO] New connection from 212.73.148.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 27 23:59:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<k/nSMfNG3Jyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 00:00:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<KjhjNfNGXNMzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 28 00:01:06 host2 sshd[2646518]: Disconnected from invalid user admin 152.32.155.11 port 46974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 00:01:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<kxq8NvNGCtAvT1jH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 28 00:01:53 host2 sshd[2647004]: Disconnected from invalid user oracle 152.32.155.11 port 42798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 00:02:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=</p7uO/NGEAinYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 28 00:03:28 host2 sshd[2648269]: Disconnected from invalid user estest 152.32.155.11 port 41230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-28 00:05:08 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:48338: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-28 00:05:21 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:55054: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 00:05:25 host2 pure-ftpd[2649767]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 00:05:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SshyRPNGPpEvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 28 00:06:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<OcobS/NGS//CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 00:06:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<u6DpSvNGnIVhSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.155.11
country_id: 1643084
description:
Dec 28 00:07:25 host2 sshd[2651011]: Disconnected from invalid user ubuntu 152.32.155.11 port 53860 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 00:09:20 host2 sshd[2652349]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 00:08:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<wCx8UvNG+sAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 00:09:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SoAJVPNGCOii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 00:10:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<n3BfV/NGDpyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-28 00:10:30 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:35424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 00:10:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<fzyKWPNGThai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 00:10:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<B/yRWfNGLs8zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-28 00:10:59 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:38946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-28 00:11:14 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:57467: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 00:13:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<sH3LY/NGas6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 00:16:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<pXwHbvNG2tNhSlS6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Dec 28 00:16:43 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.91, TLS, session=<anVkbvNGijhC5DWu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 00:17:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<35jHcPNGwI+nrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 00:17:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yGy2cPNG6j9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 00:18:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ce+/c/NGjsanrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 00:19:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<JjLWePNG/qTD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 00:20:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<SgSufPNGlp5V6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.101
country_id: 3175395
description:
Dec 28 00:20:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.169.101, lip=66.85.158.91, TLS, session=<ahkkfPNG3pC5D6ll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.113
country_id: 2963597
description:
Dec 28 00:21:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=37.203.49.113, lip=66.85.158.91, TLS, session=<8i84ffNGV6glyzFx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 00:22:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<s1hegfNGqsMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 00:21:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<iPBef/NGtup100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 00:23:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kI/vhfNG+owv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.0.101.250
country_id: 226074
description:
Dec 28 00:24:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=196.0.101.250, lip=66.85.158.91, TLS, session=<8Y8/ifNGoqrEAGX6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Dec 28 00:24:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, session=<qnS6i/NGYte4aff+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.89.10.198
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 159.89.10.198 - maximsho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.169.247.6
country_id: 1643084
description:
Dec 28 00:25:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=202.169.247.6, lip=66.85.158.91, TLS, session=<38Igi/NG5czKqfcG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Dec 28 00:25:23 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, session=<5sxljfNGxLq4aff+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 00:25:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<y7kdj/NGqkkjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.33.15
country_id: 6252001
description:
2025-12-28 00:29:10 dovecot_plain authenticator failed for H=([10.13.18.202]) [84.239.33.15]:60694: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.33.15
country_id: 6252001
description:
2025-12-28 00:29:16 dovecot_login authenticator failed for H=([10.13.18.202]) [84.239.33.15]:60694: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 00:29:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<XKJKnfNGDNov+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.66
country_id: 2413451
description:
2025-12-28 00:30:13 dovecot_login authenticator failed for H=([197.255.205.66]) [197.255.205.66]:39213: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-12-28 00:30:43 dovecot_login authenticator failed for H=([115.248.153.209]) [115.248.4.85]:56498: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 00:32:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3nv5pPNGwL8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-28 00:32:50 dovecot_login authenticator failed for H=(cm-178.232.201.31.get.no) [178.232.201.31]:53647: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-28 00:33:04 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:50556: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 00:33:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<81C1q/NGzLGnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-28 00:34:19 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:45815: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 00:34:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<tcekrvNGbtgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.199.200
country_id: 2413451
description:
2025-12-28 00:34:48 dovecot_login authenticator failed for H=([197.255.199.200]) [197.255.199.200]:39252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 00:35:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<kJgbsvNG4ogv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 00:36:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<v5FxtfNGGrCnYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.220
country_id: 6252001
description:
Dec 28 00:38:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.220, lip=66.85.158.92, TLS handshaking: Connection closed, session=<J+wevfNGrc1BMQHc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Dec 28 00:39:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XDksvvNGHO5BMQHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Dec 28 00:39:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.212, lip=66.85.158.92, TLS: Connection closed, session=<8LHEvvNGpHBBMQHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.222
country_id: 6252001
description:
Dec 28 00:39:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.222, lip=66.85.158.92, TLS, session=<0guxwPNGyvmTuYTe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.239
country_id: 6252001
description:
Dec 28 00:41:09 host2 pure-ftpd[2677619]: (?@205.210.31.239) [INFO] New connection from 205.210.31.239


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 00:42:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<tw18yvNG7KUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 00:43:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<hLlJzPNG+IcuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 00:47:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<kF4D2/NGnOMv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 00:48:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55973: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-28 00:50:16 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:44600: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 00:52:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OjLp7vNG7MMvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
country_id: 1269750
description:
2025-12-28 00:54:14 dovecot_login authenticator failed for H=([122.187.230.81]) [122.187.230.81]:37162: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 00:54:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<QNmR9PNGZj9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 00:55:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<NhFG+PNG8uUzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-12-28 00:55:20 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:41734: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-28 00:55:56 dovecot_login authenticator failed for H=(37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:33624: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 00:56:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=</l1c+/NGHskv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 00:57:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<kTTe/vNGmMmElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 00:57:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Bi9fAfRG9rSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 00:58:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<W/cvBPRGJMczTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 01:00:33 host2 sshd[2691791]: Disconnected from invalid user  62.60.131.157 port 25330 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 01:01:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<yyplDfRGECei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 01:01:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<OIPaD/RGbNtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 01:03:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BS1OFPRGRs4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 01:02:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<xwwcEfRGitCl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-28 01:02:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:57248: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 01:04:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nM2IGPRGUppnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 01:04:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<qoP5GfRGsN/Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 01:05:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<89FYG/RGvuekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 01:06:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<aVd4IfRGEqqnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 01:07:36 host2 pure-ftpd[2697165]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.89.215.95
country_id: 6252001
description:
Dec 28 01:09:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=35.89.215.95, lip=66.85.158.91, TLS: Connection closed, session=<JBbUKvRGLN4jWddf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 01:09:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<bU+uK/RGwNWnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 01:09:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TcM8LPRG+SNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 01:12:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ezdFN/RG3qcv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 01:12:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<cL07NvRGzM8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 01:15:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<GbEXP/RGVM1V6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 01:14:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<66nQPPRGN8F100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 01:14:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<aULZPPRGEMxhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 01:14:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<Oib1PfRG8LDD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.251.235
country_id: 3865483
description:
Dec 28 01:15:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.251.235, lip=66.85.158.91, TLS, session=<4EuUP/RGwM+zAPvr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.91
country_id: 690791
description:
Dec 28 01:15:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.158.91, lip=66.85.158.91, TLS, session=<swznQPRGQIUl3Z5b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 01:16:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SUq+Q/RGluIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 01:20:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<qitGUvRG/LUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 01:22:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<a91LW/RGPLenrKy4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 01:25:48 host2 sshd[2710452]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 01:26:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<OqkVZ/RGUJkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 01:26:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Lb5MZ/RGetAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 01:27:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<S4WeafRGfOAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 01:27:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<q+OJa/RGRnKnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-28 01:30:49 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:43103: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-28 01:31:00 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:42534: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 01:31:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<2RgMe/RGYooyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 01:32:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<3MYKfvRG8IsuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 01:38:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<QqdtkvRG5swv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 01:43:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<XAQ7pfRGppQvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-28 01:43:11 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64127: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-28 01:43:32 dovecot_login authenticator failed for H=([182.95.215.9]) [182.95.227.70]:55040: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Dec 28 01:44:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<G6uRp/RGjduTuYQ3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 01:44:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Z9xeqPRGsLAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 01:45:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iQcDrfRGeLkv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 28 01:45:57 host2 pure-ftpd[2726188]: (?@66.132.153.124) [INFO] New connection from 66.132.153.124


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 01:46:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Boupr/RGollo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 01:46:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<TM3tsPRGJIKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 01:47:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ToxgtPRGnKYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 01:47:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<Qti0svRGdqqElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.87
country_id: 1269750
description:
2025-12-28 01:52:27 dovecot_login authenticator failed for H=(nsg-corporate-87.229.187.122.airtel.in) [122.187.229.87]:35850: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.115.119
country_id: 2802361
description:
Dec 28 01:52:21 host2 pure-ftpd[2731180]: (?@35.240.115.119) [INFO] New connection from 35.240.115.119


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 01:52:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YqxnxPRGhkSi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 01:53:27 host2 sshd[2731720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 01:53:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<W36HyfRGGj4jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-28 01:53:25 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:48320: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-12-28 01:54:37 dovecot_login authenticator failed for H=123.129.198.203.static.netvigator.com [203.198.129.123]:51743: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-28 01:55:13 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:55794: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 01:55:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<l8yFz/RGDJ2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 01:55:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<e7wS0fRG6Jtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.202.249
country_id: 3469034
description:
Dec 28 01:56:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.93.202.249, lip=66.85.158.91, TLS, session=<j56E0PRGl5axXcr5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.96
country_id: 3175395
description:
Dec 28 01:56:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=185.15.171.96, lip=66.85.158.91, TLS, session=<4be+0fRGFei5D6tg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 01:56:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<A8bb0vRGgounrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 01:57:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<c0vh1vRGOIakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 02:00:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<lE0L4/RGvNZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 02:01:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Qt1U5vRGauzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 02:02:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MKPc6PRGZtov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 02:02:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<644R6vRGoMqnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 02:03:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<jy1e7PRGGE1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 02:04:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7dRK8PRGlMYv/lVz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:05:20 host2 pure-ftpd[2741512]: (?@59.103.102.221) [INFO] New connection from 59.103.102.221


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:05:22 host2 sshd[2741513]: Invalid user httpsaccounts.zoho.comsigninhr@lezzarotech.com from 59.103.102.221 port 60759


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:05:27 host2 pure-ftpd[2741512]: (?@59.103.102.221) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr@lezzarotech.com]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 02:06:30 host2 sshd[2742413]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:06:32 host2 pure-ftpd[2742357]: (?@59.103.102.221) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-28 02:07:00 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:16054: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-28 02:06:10 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:37674: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:06:18 host2 pure-ftpd[2742288]: (?@59.103.102.221) [INFO] New connection from 59.103.102.221


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:06:24 host2 pure-ftpd[2742288]: (?@59.103.102.221) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr@lezzarotech.com]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 02:07:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<xDt8+fRGnowjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:07:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=59.103.102.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bqmp+vRG7es7Z2bd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:07:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<httpsaccounts.zoho.comsigninhr@lezzarotech.com>, method=PLAIN, rip=59.103.102.221, lip=66.85.158.91, TLS, session=<ZtIl+/RGde47Z2bd>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 59.103.102.221
country_id: 1168579
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[995] [Remote IP Address]=[59.103.102.221] [Remote Port]=[61045] [Authentication Database]=[mail] [Username]=[httpsaccounts.zoho.comsigninhr@lezzarotech.com] (5/5 failures) (blocked until [Sat Dec 27 20:52:40 2025 UTC/Sun Dec 28 02:22:40 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 02:07:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<bCF8+/RGM4p100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.189.82.110
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 73.189.82.110 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 59.103.102.221
country_id: 1168579
description:
Dec 28 02:08:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=59.103.102.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VziC//RGFe07Z2bd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 02:09:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<a9c5AfVGvIpV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-28 02:09:26 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:57680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-28 02:09:43 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:57316: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 02:10:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<1lDkA/VG5ubD+hnW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 02:10:12 host2 pure-ftpd[2745316]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 28 02:10:22 host2 sshd[2745437]: Disconnected from invalid user nino 122.54.18.220 port 54473 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.63
country_id: 6252001
description:
Dec 28 02:10:37 host2 pure-ftpd[2745627]: (?@147.185.132.63) [INFO] New connection from 147.185.132.63


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 02:10:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<q4wiBvVGQKphSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 02:11:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Mm+PCfVGQJQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 02:12:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<5xslDPVG1panrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 28 02:13:12 host2 sshd[2747367]: Disconnected from invalid user gts 122.54.18.220 port 19570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 28 02:13:54 host2 sshd[2747630]: Disconnected from invalid user web 122.54.18.220 port 22385 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Dec 28 02:14:31 host2 sshd[2748058]: Disconnected from invalid user yq 122.54.18.220 port 58930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:16:13 host2 sshd[2748929]: Disconnected from invalid user wd 103.52.115.25 port 46096 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.227.152.155
country_id: 2635167
description:
Dec 28 02:16:47 host2 sshd[2749109]: Disconnected from invalid user user3 185.227.152.155 port 39434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-28 02:17:13 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:51094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2025-12-28 02:17:56 dovecot_login authenticator failed for H=([182.95.61.82]) [182.95.61.82]:59706: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 02:18:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<8lfLIPVGrF6nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:18:33 host2 sshd[2752841]: Disconnected from invalid user vpnuser1 103.52.115.25 port 41618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 02:18:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3EdKI/VG1Mgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 02:19:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<MxDLI/VGRrYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:19:12 host2 sshd[2755028]: Disconnected from invalid user steve 103.52.115.25 port 48140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec 28 02:19:50 host2 sshd[2757028]: Disconnected from invalid user test2 103.52.115.25 port 45716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 02:21:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<RZKcLPVGcrEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 02:22:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<B/ncLvVGcJwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 02:22:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<xNBfL/VGIosuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.64.39.41
country_id: 953987
description:
Dec 28 02:29:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=102.64.39.41, lip=66.85.158.91, TLS, session=<As4OR/VGD7BmQCcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.135
country_id: 3469034
description:
Dec 28 02:29:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=177.44.96.135, lip=66.85.158.91, TLS, session=<FQ5jSPVGCJyxLGCH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 02:30:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<dIAVTfVGArYv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 02:33:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JxMDWPVGXrQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 02:35:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<UQ5HX/VGpNUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2025-12-28 02:36:02 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:44404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 02:37:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Q4wZZPVGSK8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 02:36:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pqn8YPVGuqAv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.227
country_id: 357994
description:
2025-12-28 02:36:22 dovecot_login authenticator failed for H=([195.43.5.227]) [195.43.5.227]:58415: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 02:36:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<GaZqYvVGBIii8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-28 02:36:43 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:34734: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 02:38:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Yu27Z/VGHLto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 02:38:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<IWyiafVGPouElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-28 02:39:21 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (brept) [71.224.169.28]:60564: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.177
country_id: 6252001
description:
Dec 28 02:40:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<li7XcPVG8dDN0h+x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 02:45:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<rN6GgPVGhv+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 02:45:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5Tx5gvVGHjsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 02:46:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tCqdhfVG+rynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 02:48:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TD7ji/VGrMVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 02:48:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<tVdJjvVGgJWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 02:50:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<vCGPlPVG9sOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-28 02:51:55 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:52063: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-28 02:51:40 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:52602: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 02:53:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WlYxnfVGnucv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 02:55:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<goKnp/VGjMGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 02:56:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<XL+2qvVGLKEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 02:58:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Rxwdr/VGlqvBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 02:58:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<r+5rr/VGWzNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 02:59:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<nJCgs/VGQG4jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.246.4
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.28.246.4 - kamechot "GET /json-api/cpanel?api.version=1&cpanel_jsonapi_module=Fileman&cpanel_jsonapi_func=listfiles HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 03:00:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<bQLuuPVG1pZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 03:01:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xTNfu/VGU1V100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 03:01:50 host2 sshd[2804456]: Disconnected from invalid user  62.60.131.157 port 20198 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:02:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<bFNTwPVG9OOnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 03:04:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<tFeBxPVGrqwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 03:04:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<lyFfxfVGFJBV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 03:06:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<G6/HzfVGesTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-28 03:07:03 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:48062: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 03:09:07 host2 sshd[2808450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 03:08:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=</LE11vVG8s9hSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 03:09:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<kQeP1vVGJjenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-12-28 03:09:54 dovecot_plain authenticator failed for H=dsl540122f2.fixip.t-online.hu (hestin) [84.1.34.242]:46100: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-28 03:11:09 dovecot_login authenticator failed for H=222.42.246.220.static.netvigator.com [220.246.42.222]:59674: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-28 03:11:37 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:33787: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 03:11:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<+0rZ4PVGsLIv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.68.150
country_id: 1835841
description:
Dec 28 03:13:34 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=118.193.68.150, lip=66.85.158.91, session=<GCje5vVGLNR2wUSW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.68.150
country_id: 1835841
description:
Dec 28 03:14:12 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=118.193.68.150, lip=66.85.158.92, session=<Rgkc6fVG0qt2wUSW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:14:51 dovecot_login authenticator failed for H=(3fDj0Z39) [160.25.73.147]:56348: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:15:15 dovecot_login authenticator failed for H=(xYrA9SPP) [160.25.73.147]:65345: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[51148] [Authentication Database]=[mail] [Username]=[admin@rehanseo.online] (10/10 failures) (blocked until [Sun Dec 28 21:46:17 2025 UTC/Mon Dec 29 03:16:17 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 03:16:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EEaX8PVGzMcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.73.147
country_id: 1562822
description:
2025-12-28 03:16:27 dovecot_login authenticator failed for H=(4i5VEWR4wK) [160.25.73.147]:63014: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 160.25.73.147
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[160.25.73.147] [Authentication Database]=[mail] [Username]=[info@lezzarotech.com] (5/5 failures) (blocked until [Sat Dec 27 22:01:25 2025 UTC/Sun Dec 28 03:31:25 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.177
country_id: 1269750
description:
Dec 28 03:18:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.84.202.177, lip=66.85.158.91, TLS, session=<gx/19vVGuoxnVMqx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.6
country_id: 1269750
description:
Dec 28 03:18:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.246.170.6, lip=66.85.158.91, TLS, session=<R8E6+PVGh8Jn9qoG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 28 03:21:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<mMLRAfZGIf/CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 03:23:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<3R2gCPZGMqMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 03:23:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sZh/CvZGIp8v7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 03:25:33 host2 sshd[2824898]: Disconnected from invalid user armani 62.60.131.157 port 5953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 03:26:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<xjOwFPZG6K6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 03:26:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<RyLoFPZGsIszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 03:27:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gRTjFvZGRogv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:28:55 host2 sshd[2827726]: Disconnected from invalid user esuser 209.141.43.77 port 43936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:30:12 host2 sshd[2828508]: Disconnected from invalid user cindy 54.38.52.18 port 49190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 03:29:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<uVTIHvZGcqsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 03:29:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<zGuyIPZGGPNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 03:31:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<xYt/JfZGRtqElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:31:25 host2 sshd[2829214]: Disconnected from invalid user proxyuser 209.141.43.77 port 51020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.94.163.47
country_id: 6252001
description:
Dec 28 03:31:59 host2 pure-ftpd[2829537]: (?@155.94.163.47) [INFO] New connection from 155.94.163.47


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:32:53 host2 sshd[2830429]: Disconnected from invalid user zhangsong 209.141.43.77 port 46680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 28 03:33:35 host2 sshd[2831202]: Disconnected from invalid user git 209.141.43.77 port 58626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-12-28 03:33:48 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:55653: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-28 03:34:06 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:46830: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 28 03:33:28 host2 sshd[2831051]: Disconnected from invalid user oracle 103.82.240.194 port 38228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 28 03:35:51 host2 sshd[2833073]: Disconnected from invalid user xyh 103.82.240.194 port 33200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:36:01 host2 sshd[2833235]: Disconnected from invalid user alba 54.38.52.18 port 33740 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 03:36:36 host2 sshd[2833650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 28 03:36:28 host2 sshd[2833555]: Disconnected from invalid user minecraft 152.32.172.161 port 46068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:37:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<DMKcPPZGKr6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 03:37:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dhRePfZGmD0jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 28 03:38:16 host2 sshd[2834887]: Disconnected from invalid user oracle 152.32.172.161 port 40966 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 54.38.52.18
country_id: 798544
description:
Dec 28 03:38:30 host2 sshd[2835041]: Received disconnect from 54.38.52.18 port 39608:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 03:38:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qff5P/ZG1E+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 28 03:41:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.91, TLS: Connection closed, session=</QugSfZGRKuVHDF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 03:40:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<peC5SPZGcI9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2025-12-28 03:41:48 dovecot_login authenticator failed for H=([122.187.230.194]) [122.187.230.194]:32996: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-28 03:42:10 dovecot_login authenticator failed for H=([80.227.147.94]) [80.227.147.94]:33753: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 03:41:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<j8TdSvZGjNSl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:42:34 host2 sshd[2837867]: Disconnected from invalid user cassandra 181.46.131.55 port 57636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 03:43:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<KO9wUPZGqMOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 03:44:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<9kRfVPZGNNsv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:44:33 host2 sshd[2839415]: Disconnected from invalid user share 205.185.125.150 port 38316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:45:15 host2 sshd[2840636]: Disconnected from invalid user oracle 205.185.125.150 port 50110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 28 03:45:53 host2 sshd[2841453]: Disconnected from invalid user ymoreno 205.185.125.150 port 33668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 28 03:46:07 host2 sshd[2841835]: Disconnected from invalid user ymoreno 103.88.76.27 port 35648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 28 03:48:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<p6QGYvZGNP7CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 03:48:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tR9ZZPZGyr0v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 28 03:50:23 host2 sshd[2845559]: Disconnected from invalid user oracle 103.88.76.27 port 44558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 03:50:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<WuRVa/ZGspSnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 03:50:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<uj9sbPZGfNzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 03:51:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6fhhbvZGVo8jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2025-12-28 03:52:17 dovecot_login authenticator failed for H=([122.187.223.78]) [182.66.214.34]:47174: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 03:52:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<3dZUcfZGdRRniu0S>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 28 03:52:40 host2 sshd[2847482]: Received disconnect from 195.25.17.31 port 12944:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-28 03:52:44 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:55936: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:53:23 host2 sshd[2848029]: Disconnected from invalid user diego 181.46.131.55 port 43210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 03:54:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rbudePZGvqynrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 03:55:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2/AMe/ZGTOJ100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2025-12-28 03:55:53 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:40064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-28 03:56:09 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:44264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.226.238.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 162.226.238.137 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.50.216.87
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.50.216.87 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.128.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.128.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.35.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.97.35.122 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 28 03:56:14 host2 sshd[2850788]: Disconnected from invalid user user 195.25.17.31 port 29329 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 03:56:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<MWQrgPZG5Isv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.127.104.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.127.104.107 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.174.2.163
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 146.174.2.163 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.212.171.147
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.212.171.147 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.219.194.87
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.219.194.87 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.35.200.45
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.35.200.45 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.117.79.21
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 152.117.79.21 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.183.205.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.183.205.135 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.179.26.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.179.26.107 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.61.16.53
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.61.16.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.221.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.221.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.140
country_id: 1269750
description:
Dec 28 03:57:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.140, lip=66.85.158.91, TLS, session=<J9u5g/ZGK9hnpPaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.229
country_id: 3469034
description:
Dec 28 03:58:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.72.229, lip=66.85.158.91, TLS, session=<8vj0hPZGHbW7eEjl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 03:59:22 host2 sshd[2853311]: Disconnected from invalid user user 181.46.131.55 port 59696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 03:59:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<af88jPZGFqhV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-28 03:59:54 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:37317: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 04:00:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NLrLj/ZGvoJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 04:02:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Cf0XlPZGdMAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 04:01:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MXCHkfZGWlmnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 28 04:01:39 host2 sshd[2855184]: Disconnected from invalid user sens 181.46.131.55 port 50034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 04:03:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<CFoZmPZGirnD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.68.231
country_id: 2921044
description:
Dec 28 04:03:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.68.231, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UTAbm/ZGv+JEt0Tn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:04:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<AM7NnPZGPJ0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 04:04:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kEv8nPZGqOEyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 04:04:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.71.87, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0OU0nfZGdqGl6EdX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.190.12.98
country_id: 3608932
description:
Dec 28 04:05:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=201.190.12.98, lip=66.85.158.91, session=</b3JofZGbtbJvgxi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 04:06:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</7yypPZGrrkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 04:08:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<Mw5Zq/ZGgsVhSlS6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.127.133
country_id: 6252001
description:
Dec 28 04:10:28 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.127.133, lip=66.85.158.92, session=<FrBUsvZGRlOs7H+F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:11:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jFB4tPZGGOIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 04:13:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<Z2sPvvZGXKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 04:14:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<oJXJwPZG6MWi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.142.115
country_id: 1655842
description:
Dec 28 04:14:39 host2 sshd[2867715]: Disconnected from invalid user vyos 202.137.142.115 port 34496 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 04:15:03 host2 pure-ftpd[2868341]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 04:16:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Y0xjxvZG1NAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 04:15:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<dC4AxPZGgoOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 04:15:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9dx5xfZGWuii8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2025-12-28 04:16:00 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:37110: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 04:17:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55381: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 04:17:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0Hrly/ZGEMsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:17:53 host2 sshd[2871166]: Disconnected from invalid user ftpuser 85.185.120.213 port 39840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 04:18:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<rXKu0PZGMIykXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:19:08 host2 sshd[2872695]: Disconnected from invalid user bot 223.123.65.45 port 43378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 04:18:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dj/mzvZGCIFnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:20:11 host2 sshd[2874190]: Disconnected from invalid user admin 85.185.120.213 port 59182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:21:30 host2 sshd[2875760]: Disconnected from invalid user smbuser 223.123.65.45 port 36804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:21:38 host2 sshd[2875905]: Disconnected from invalid user debian 24.144.124.91 port 41206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 04:23:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<fC453/ZGpOWnrEV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.45
country_id: 1168579
description:
Dec 28 04:23:12 host2 sshd[2877815]: Disconnected from invalid user dylan 223.123.65.45 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 04:22:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<75RD3PZGnSVniu0S>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:22:53 host2 sshd[2877370]: Received disconnect from 85.185.120.213 port 41348:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:22:53 host2 sshd[2877370]: Disconnected from invalid user master 85.185.120.213 port 41348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:23:23 host2 sshd[2878059]: Disconnected from invalid user steam 24.144.124.91 port 53824 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 04:23:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Kw/b4PZGYL2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.233
country_id: 1269750
description:
Dec 28 04:23:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.164.246.233, lip=66.85.158.91, TLS, session=<sO9h4fZGzbZnpPbp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.212
country_id: 99237
description:
Dec 28 04:24:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=65.20.143.212, lip=66.85.158.91, TLS, session=<m6uR4vZGv9JBFI/U>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec 28 04:24:30 host2 sshd[2879371]: Disconnected from invalid user mohit 85.185.120.213 port 39720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 04:24:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<T+7e5fZGrLnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 04:25:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<pl6E6fZG4rNV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 04:26:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<7roX6/ZG9u5100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 28 04:26:30 host2 sshd[2881737]: Disconnected from invalid user odoo 24.144.124.91 port 45608 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:27:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<z3qf7vZGHKIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 04:28:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<uZp78vZGaJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 04:30:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vr67+vZGRMkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 04:34:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4OGvCfdG1uQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-28 04:38:53 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:53734: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 04:39:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<HcvXGPdGkrqnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 04:39:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<IYIGG/dG/JQFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-28 04:39:50 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:52523: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:40:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<L9EjHfdGlJ4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-28 04:40:31 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:56879: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-28 04:40:58 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:59589: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 04:41:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8FNzH/dGSLIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 04:42:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<UNRXJvdGuIenYwhf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.195.254
country_id: 6252001
description:
Dec 28 04:43:53 host2 pure-ftpd[2899780]: (?@20.127.195.254) [INFO] New connection from 20.127.195.254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 04:47:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=</n1TN/dG9osyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 04:48:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<xUYWO/dGpIAuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 04:51:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<9DBvRfdGeowv7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 04:52:16 host2 sshd[2909981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 28 04:53:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.155, lip=66.85.158.91, session=<P5/2TfdGkf8t4/6b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-28 04:54:11 dovecot_login authenticator failed for H=([84.213.191.100]) [84.213.191.100]:46452: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-28 04:53:46 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:50867: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 28 04:56:22 host2 sshd[2914748]: Disconnected from invalid user joel 118.193.39.127 port 36742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 04:57:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<vFpIWfdGGMovWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 28 04:57:33 host2 sshd[2915829]: Disconnected from invalid user openwrt 118.193.39.127 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 28 04:58:46 host2 sshd[2916988]: Disconnected from invalid user server1 164.92.106.89 port 41892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 04:59:03 host2 sshd[2917241]: Disconnected from invalid user  62.60.131.157 port 17243 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Dec 28 04:59:20 host2 sshd[2917488]: Disconnected from invalid user mapadmin 164.92.106.89 port 54152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-28 04:59:28 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:58366: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:00:05 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QcO0Y/dGBMgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 05:00:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Ygl2ZfdG1Kpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:00:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<tdGrZvdGhI4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 05:02:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<6t0EbPdGXtyElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:03:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<je1kb/dGUM8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 05:03:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<gvqMb/dG/q+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-28 05:05:16 dovecot_login authenticator failed for H=([122.187.223.48]) [128.185.201.170]:57034: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2025-12-28 05:05:44 dovecot_login authenticator failed for H=([122.187.230.82]) [122.187.230.82]:60775: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:06:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<AaKwevdG9rwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 05:06:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<83RDfPdGFIel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.179
country_id: 3175395
description:
Dec 28 05:07:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.171.179, lip=66.85.158.91, TLS, session=<gNavfPdGfci5D6uz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 05:07:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gvjHffdG0hKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.252
country_id: 1269750
description:
Dec 28 05:07:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.55.105.252, lip=66.85.158.91, TLS, session=</YLVffdGcLNnN2n8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:07:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pzW7f/dGWjMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Dec 28 05:08:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<0BVVgfdGgIBhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 05:08:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<4nyTgfdGTMlA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 28 05:08:32 host2 sshd[2925322]: Disconnected from invalid user lighthouse 162.240.39.179 port 35492 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 05:08:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<mBN8gvdGZqjBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 05:09:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VOVEhfdGZL1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 05:10:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<b6ZUh/dGdJakXF7M>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 28 05:09:39 host2 sshd[2925908]: Received disconnect from 162.240.39.179 port 59270:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Dec 28 05:10:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<pXBAh/dGBtMvT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 05:11:00 host2 sshd[2927241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.103.6.1
country_id: 690791
description:
Dec 28 05:10:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.103.6.1, lip=66.85.158.91, TLS, session=<G7abifdG9dmwZwYB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.121.185
country_id: 6290252
description:
Dec 28 05:11:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.121.185, lip=66.85.158.91, TLS, session=<4q2yivdGZqFtznm5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 05:11:57 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<xf0WjvdGVsmnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.7
country_id: 2328926
description:
Dec 28 05:13:45 host2 pure-ftpd[2929184]: (?@102.204.223.7) [INFO] New connection from 102.204.223.7


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 05:14:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<uzFumPdGZTVniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-28 05:15:35 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:56352: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 05:15:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<d2rrm/dG9JenrEV8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 05:15:53 host2 pure-ftpd[2931208]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2025-12-28 05:16:05 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:46630: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.57.131
country_id: 6252001
description:
Dec 28 05:17:06 host2 pure-ftpd[2932025]: (?@20.106.57.131) [INFO] New connection from 20.106.57.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:17:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SY00ofdGxrIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 05:18:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PPHBpPdGI9p100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:18:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MCvIpfdG8tQv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 28 05:19:34 host2 sshd[2934001]: Disconnected from invalid user monica 160.251.197.41 port 38192 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 05:19:48 host2 sshd[2934209]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Dec 28 05:19:35 host2 sshd[2934030]: Disconnected from invalid user deployer 40.117.97.0 port 38436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 05:19:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<AWD8qfdGSttV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:21:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OEuHr/dGaKEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 05:21:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<vucusPdGeuTD+hnW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.152.158
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.59.152.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.198.3.123
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.198.3.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.154.184.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.154.184.103 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.80.143.197
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.80.143.197 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.172.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.112.172.162 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.78.197
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 129.222.78.197 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-28 05:23:16 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:48753: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.97.181
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.17.97.181 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.205.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.113.205.178 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.107.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.107.244 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.76.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 50.158.76.237 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.189.16.18
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.189.16.18 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.9.59
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.244.9.59 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.86.192
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.164.86.192 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.189.129.23
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.189.129.23 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 28 05:24:07 host2 sshd[2937595]: Disconnected from invalid user db2fenc2 160.251.197.41 port 45174 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.95
country_id: 2921044
description:
Dec 28 05:23:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.101.122.95, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ARjdt/dGNsguZXpf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-28 05:23:39 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:54891: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-28 05:25:33 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:53630: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 05:24:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<N0Ftu/dGBscv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 28 05:24:52 host2 sshd[2937959]: Disconnected from invalid user oracle 4.210.186.201 port 40161 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 05:27:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Alo6x/dG6JWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.16
country_id: 2186224
description:
2025-12-28 05:29:30 dovecot_login authenticator failed for H=([121.73.169.16]) [121.73.169.16]:38154: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-28 05:29:42 dovecot_login authenticator failed for H=(dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:48928: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 05:31:27 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3B7X0/dGLJwFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 05:31:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<iu9a1PdG7o8v7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.81.106
country_id: 2921044
description:
Dec 28 05:32:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.122.81.106, lip=66.85.158.91, session=<Jdfv1fdGhf6GelFq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.71.87
country_id: 2921044
description:
Dec 28 05:32:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.71.87, lip=66.85.158.91, session=<3Qb81fdGQvOl6EdX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-28 05:32:12 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:32860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 05:33:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<fe7w2vdGSrOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-28 05:32:35 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:57778: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 05:33:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<SMmk2fdGwJYv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.42
country_id: 6252001
description:
Dec 28 05:35:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+8oB4fdGqIoUqwgq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 05:38:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<JWAE7fdGMqwuZXpm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.150.192.39
country_id: 6252001
description:
Dec 28 05:37:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.150.192.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UdTk6vdGerMUlsAn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 05:37:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<K9I+6/dGdqEyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-28 05:38:53 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:57974: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-28 05:39:05 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:48274: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 05:43:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<K/Br/fdG6uwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 05:47:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<WP5mC/hGFp0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:47:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<FS9CDvhGVOczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-28 05:48:26 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:55476: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2025-12-28 05:49:32 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:32844: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2025-12-28 05:48:46 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:50528: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-28 05:49:53 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:59481: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 05:50:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<wYEOF/hGOogv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 05:51:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<M3slGvhGFLgzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec 28 05:51:29 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.92, session=<PAWhG/hGusWsaYAL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 05:52:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<f1LFHvhG8J5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 05:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<IKEbIfhGKL2ElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 05:53:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<sdQaIfhGppWi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-28 05:57:58 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (anirlamity) [89.25.223.210]:56416: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 05:58:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<585TNvhGEJul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 05:58:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<49lJNvhGiC8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 05:59:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<D6w2OPhGDoWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:00:07 host2 sshd[2963909]: Disconnected from invalid user ryan 202.51.214.99 port 50594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 06:01:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CleNPvhGgMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:01:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<uVnAPvhGYJenrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:02:06 host2 sshd[2965409]: Disconnected from invalid user webuser 202.51.214.99 port 48494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:01:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3f1iP/hGVLYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 06:01:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Nn6uP/hG/KCkXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.99
country_id: 1643084
description:
Dec 28 06:02:46 host2 sshd[2965818]: Disconnected from invalid user toro 202.51.214.99 port 60132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 06:04:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<Ea+dSfhGLLrBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-28 06:04:58 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:36146: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-28 06:05:20 dovecot_login authenticator failed for H=([122.187.193.1]) [182.95.178.154]:34074: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
country_id: 3469034
description:
2025-12-28 06:05:55 dovecot_login authenticator failed for H=([177.174.89.105]) [177.174.89.99]:54397: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:06:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZktHUvhGqLIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.240.104
country_id: 3469034
description:
Dec 28 06:07:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.92.240.104, lip=66.85.158.91, TLS, session=<80tVUvhGgbixXPBo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-28 06:07:36 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:41883: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 06:07:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gCJuVvhG+xFniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-28 06:08:01 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:58498: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.112
country_id: 3057568
description:
Dec 28 06:07:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=91.226.115.112, lip=66.85.158.91, TLS, session=<FeErVPhGgMpb4nNw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-28 06:08:27 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:55849: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:08:37 host2 sshd[2969885]: Disconnected from invalid user  62.60.131.157 port 7743 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:10:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3De6XfhGbNAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2025-12-28 06:10:03 dovecot_login authenticator failed for H=([128.185.231.114]) [128.185.231.114]:44060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-12-28 06:10:18 dovecot_login authenticator failed for H=104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:60405: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 06:09:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Yli3W/hGlpOnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.141.76
country_id: 690791
description:
Dec 28 06:11:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.141.76, lip=66.85.158.91, TLS, session=<DBGQYPhGYMcl3Y1M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 06:10:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<iM4WYPhGXM1100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 83.143.30.71
country_id: 933860
description:
Dec 28 06:10:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=83.143.30.71, lip=66.85.158.91, TLS, session=<mQVNX/hGF91Tjx5H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 06:12:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<17UnZvhGCHwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 06:14:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<fHgHbPhG1MRV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-28 06:14:50 dovecot_login authenticator failed for H=([182.95.52.206]) [182.95.52.206]:39626: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 06:15:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<SxXVb/hG5qgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-28 06:15:14 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:52350: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:17:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<FXnMePhGjpmnrKy4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 06:18:21 host2 pure-ftpd[2977409]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 06:18:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<SeiKffhGYLbD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 06:23:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<QM6+jfhGAoQv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-28 06:23:30 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:59570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 06:23:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<gcuVjvhGPmynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.141
country_id: 2413451
description:
2025-12-28 06:23:41 dovecot_login authenticator failed for H=([197.255.200.141]) [197.255.200.141]:36479: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 06:24:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<YLatkPhG/MsFhXlo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - essencec "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:25:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<cQ1tlPhGStEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 06:28:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Zw8yoPhG5oQuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 06:29:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Drg5o/hGAL0yBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.242
country_id: 6252001
description:
Dec 28 06:29:58 host2 pure-ftpd[2985545]: (?@38.148.242.242) [INFO] New connection from 38.148.242.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:31:36 host2 sshd[2986993]: Disconnected from invalid user  62.60.131.157 port 33581 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 06:34:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<OnUOt/hGIuMv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.243.253.241
country_id: 3577718
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 104.243.253.241 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 06:36:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<iL1Bu/hGwMAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 06:37:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ldFywPhG6tsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 06:39:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</NhAx/hGKtQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-28 06:39:38 dovecot_login authenticator failed for H=u153-26.static.grape.cz [93.91.153.26]:53665: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:39:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vCTKyPhGLM4v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-28 06:40:10 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:39262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.119.65.249
country_id: 690791
description:
Dec 28 06:43:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.119.65.249, lip=66.85.158.91, TLS, session=<VVw+1PhGCaOwd0H5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 06:43:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<AHDA1PhGrNyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 06:43:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<b9qE1fhGRKVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.131
country_id: 2510769
description:
Dec 28 06:43:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.145.43.131, lip=66.85.158.91, TLS, session=<8XFS1fhGYLO5kSuD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 06:44:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<kQL12PhG7J2ElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 06:50:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XLfU7fhGGncjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 28 06:51:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ZDgE8fhGWsKl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.112
country_id: 6252001
description:
Dec 28 06:50:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.112, lip=66.85.158.91, TLS, session=<mQJt8PhGIP/G6xhw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 28 06:52:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gwUk9PhGvDKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 06:51:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Ws3L8vhGpp6nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 28 06:53:15 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6kds+PhGXNmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 28 06:54:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<BS6n+/hGHtVnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 06:54:41 host2 sshd[3005135]: Disconnected from invalid user  62.60.131.157 port 39049 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 06:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<yHgUBPlGcMYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 06:56:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1x+FBPlGWNgv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.246
country_id: 6252001
description:
Dec 28 07:00:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.246, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9KopEvlGV9fN0h/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Dec 28 07:00:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<3bMNFPlG5NXBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 28 07:01:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7gDDFPlGxz5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:02:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<noYIGPlG9L0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 28 07:02:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<3FRdGvlGlM6nrEV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.114.107
country_id: 2921044
description:
Dec 28 07:02:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=157.230.114.107, lip=66.85.158.91, session=<yc9UG/lGK+ed5nJr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.128.120
country_id: 2921044
description:
Dec 28 07:03:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.128.120, lip=66.85.158.91, session=<AUpiG/lGwNWkXIB4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 28 07:03:17 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<L01FHPlGnUR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 28 07:03:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GHS5HflG+sQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 28 07:05:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VuD1JflGDoov+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 28 07:07:49 host2 sshd[3015274]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 28 07:07:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<zrACLPlGwrhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 28 07:08:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<GZsULvlGqJinrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 28 07:08:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<0Q7GL/lGKp5V6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.229
country_id: 3175395
description:
Dec 28 07:10:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.170.229, lip=66.85.158.91, TLS, session=<F1y0NflGjtK5D6rl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.61.2
country_id: 2215636
description:
Dec 28 07:10:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=165.16.61.2, lip=66.85.158.91, TLS, session=<TQnWNvlGRKylED0C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 28 07:12:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4ki0PvlGEDlChJmA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 28 07:12:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WxX7PvlGDFKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 07:15:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<7FlRSPlGJOUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 28 07:16:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9d8DTPlGcI3D+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 28 07:17:36 host2 sshd[3022726]: Disconnected from invalid user  62.60.131.157 port 15799 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 28 07:17:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<le00UPlGBI4FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 28 07:17:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Al9QUPlGdt8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2025-12-28 07:18:35 dovecot_login authenticator failed for H=([122.187.230.227]) [122.187.230.227]:46663: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 28 07:19:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<Gt6YVPlGCsEuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-28 07:19:08 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:34076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 28 07:20:59 host2 pure-ftpd[3025572]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 28 07:21:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<vjtoXflGarAyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-28 07:21:42 dovecot_plain authenticator failed for H=(applar) [75.97.190.237]:59830: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 07:25:12 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<4mStavlGEIAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-28 07:26:17 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:35142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.102
country_id: 3996063
description:
2025-12-28 07:26:59 dovecot_login authenticator failed for H=(187.161.222.102-clientes-izzi.mx) [187.161.222.102]:46404: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 28 07:27:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O5uScflGmNMv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-28 07:26:34 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:34373: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 28 07:28:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<TnbxdvlGbqgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 28 07:28:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Xjikd/lG+KwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.200.204
country_id: 2413451
description:
2025-12-28 07:29:28 dovecot_login authenticator failed for H=([197.255.200.204]) [197.255.200.204]:45384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 28 07:30:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<A4GqfPlGdMIv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-28 07:32:25 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54784: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 28 07:33:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5hfgiflGSIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 28 07:35:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<uCRQjvlGKjFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 28 07:36:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<zOeglPlGGu2ElEgp>


