# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Dec 18 23:50:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.10, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PHT2Aj5GzrlAPpwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.198
country_id: 6252001
description:
Dec 18 23:49:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.198, lip=66.85.158.91, session=<ev5pAD5GgSFAPpzG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Dec 18 23:49:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS: Connection closed, session=<OakzAT5GvqhAPpzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 23:49:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<TMB8AT5GNuo+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.23
country_id: 6252001
description:
Dec 18 23:49:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.23, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cfTxAT5G7yJAPpwX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Dec 18 23:50:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.10, lip=66.85.158.92, TLS: Connection closed, session=<+MfgAz5GTmtAPpwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 18 23:52:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<CbXPDD5Gaf7CpRCj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 23:53:55 host2 sshd[3549525]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 18 23:56:39 host2 sshd[3551786]: Disconnected from invalid user gmodserver1 45.172.153.100 port 56388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-18 23:56:28 dovecot_login authenticator failed for (187.161.222.157-clientes-izzi.mx) [187.161.222.157]:38800: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 23:56:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<0ppSGT5GarY+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-18 23:57:50 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:33564: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.82.181.183
country_id: 6252001
description:
2025-12-18 23:57:20 dovecot_login authenticator failed for ool-4352b5b7.dyn.optonline.net [67.82.181.183]:57100: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-18 23:57:22 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:39402: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 00:00:47 host2 sshd[3554838]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 19 00:00:39 host2 sshd[3554749]: Disconnected from invalid user andrey 45.172.153.100 port 59038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 19 00:01:21 host2 sshd[3555247]: Disconnected from invalid user smkim 45.172.153.100 port 56628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 19 00:02:43 host2 sshd[3555906]: Disconnected from invalid user admin 45.172.153.100 port 48172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Dec 19 00:02:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, session=<c8h8MD5GhKG4aff8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 00:03:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<dE62MT5GzIk+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.153.100
country_id: 3508796
description:
Dec 19 00:03:19 host2 sshd[3556542]: Disconnected from invalid user jeff 45.172.153.100 port 45480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.252
country_id: 6252001
description:
Dec 19 00:03:24 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.252, lip=66.85.158.92, session=<zqUuMj5GyAy4aff8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.201.35.147
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 67.201.35.147 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Dec 19 00:06:05 host2 sshd[3558441]: Disconnected from invalid user root2 51.68.226.87 port 49062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 19 00:06:13 host2 sshd[3558558]: Disconnected from invalid user yuanfeng 104.152.40.8 port 42040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 00:06:46 host2 sshd[3558899]: Disconnected from invalid user admin 2.57.121.112 port 57952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 00:07:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<96CrPz5G7pQ+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.226.87
country_id: 3017382
description:
Dec 19 00:07:46 host2 sshd[3559495]: Disconnected from invalid user aluno 51.68.226.87 port 50086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 19 00:07:51 host2 sshd[3559565]: Disconnected from invalid user roger 198.23.143.193 port 53516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.227.153.163
country_id: 2635167
description:
Dec 19 00:08:47 host2 sshd[3560008]: Disconnected from invalid user student 185.227.153.163 port 45796 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.166.167.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 70.166.167.47 - info@essenceceylontea.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@essenceceylontea.com has their account suspended. Login blocked.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 19 00:09:38 host2 sshd[3560609]: Disconnected from invalid user cubrid 198.23.143.193 port 34166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.232.145
country_id: 6252001
description:
Dec 19 00:09:52 host2 sshd[3560744]: Disconnected from invalid user paula 143.198.232.145 port 53418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 19 00:09:18 host2 sshd[3560476]: Disconnected from invalid user student 140.106.25.217 port 57668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 19 00:09:20 host2 sshd[3560489]: Disconnected from invalid user temp 104.152.40.8 port 45498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Dec 19 00:10:14 host2 sshd[3561085]: Disconnected from invalid user db 160.202.8.218 port 56466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.227.153.163
country_id: 2635167
description:
Dec 19 00:10:32 host2 sshd[3561281]: Disconnected from invalid user omni 185.227.153.163 port 55560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Dec 19 00:11:23 host2 sshd[3561829]: Disconnected from invalid user git 51.68.226.87 port 53114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.232.145
country_id: 6252001
description:
Dec 19 00:11:56 host2 sshd[3562137]: Disconnected from invalid user tuan 143.198.232.145 port 56552 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 19 00:12:01 host2 sshd[3562167]: Received disconnect from 140.106.25.217 port 34762:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 19 00:12:01 host2 sshd[3562167]: Disconnected from invalid user deploy 140.106.25.217 port 34762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 19 00:12:11 host2 sshd[3562284]: Disconnected from invalid user omni 103.132.243.250 port 42454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 19 00:12:23 host2 sshd[3562425]: Disconnected from invalid user openstack 104.152.40.8 port 48952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.180.91
country_id: 6252001
description:
Dec 19 00:12:27 host2 sshd[3562468]: Disconnected from invalid user laura 23.94.180.91 port 50418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 19 00:12:39 host2 sshd[3562585]: Disconnected from invalid user yang 198.23.143.193 port 39560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 19 00:14:08 host2 sshd[3563485]: Disconnected from invalid user git 103.132.243.250 port 34898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.50
country_id: 3144096
description:
2025-12-19 00:13:29 dovecot_login authenticator failed for (ADMIN) [46.246.122.50]:62048: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 19 00:13:36 host2 sshd[3563222]: Disconnected from invalid user oracle 104.152.40.8 port 44696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.232.145
country_id: 6252001
description:
Dec 19 00:13:42 host2 sshd[3563265]: Disconnected from invalid user es 143.198.232.145 port 52400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 19 00:13:49 host2 sshd[3563337]: Disconnected from invalid user zhangsan 198.23.143.193 port 36066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 00:17:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<TfBZYz5GJJc+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 00:18:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<xz6jZj5GNtI+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 19 00:18:32 host2 sshd[3566459]: Disconnected from invalid user roger 103.132.243.250 port 42772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.140
country_id: 6252001
description:
2025-12-19 00:20:10 dovecot_login authenticator failed for wsip-184-191-250-140.fv.ks.cox.net [184.191.250.140]:49528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.9
country_id: 6252001
description:
2025-12-19 00:20:28 dovecot_login authenticator failed for ([98.185.120.9]) [98.185.120.9]:54371: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.180.91
country_id: 6252001
description:
Dec 19 00:21:47 host2 sshd[3568705]: Disconnected from invalid user student 23.94.180.91 port 49136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-19 00:23:22 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:57190: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.3
country_id: 6252001
description:
2025-12-19 00:23:54 dovecot_login authenticator failed for wsip-184-191-243-3.fv.ks.cox.net [184.191.243.3]:41285: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 19 00:24:27 host2 sshd[3570228]: Disconnected from invalid user yannick 194.87.187.47 port 34118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.233.191
country_id: 6252001
description:
Dec 19 00:24:23 host2 sshd[3570205]: Disconnected from invalid user reseller 192.3.233.191 port 46020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.233.191
country_id: 6252001
description:
Dec 19 00:25:27 host2 sshd[3571159]: Disconnected from invalid user tuesday 192.3.233.191 port 56102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-19 00:27:07 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:38286: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.195.34.50
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 72.195.34.50 - info@colourmarklabels.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-19 00:27:27 dovecot_login authenticator failed for ([182.95.60.146]) [182.95.60.146]:42654: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.20
country_id: 2635167
description:
Dec 19 00:27:56 host2 sshd[3572602]: Disconnected from invalid user username1 196.196.253.20 port 44838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-19 00:29:05 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:59814: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Dec 19 00:28:27 host2 sshd[3573077]: Disconnected from invalid user bit 196.196.253.20 port 44906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.248.3.24
country_id: 6252001
description:
2025-12-19 00:29:17 dovecot_login authenticator failed for (cust-ip-162-248-3-24.wtrt.net) [162.248.3.24]:57897: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Dec 19 00:29:27 host2 sshd[3573730]: Disconnected from invalid user forge 196.196.253.20 port 45022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 19 00:31:14 host2 sshd[3575152]: Disconnected from invalid user username1 194.87.187.47 port 48210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.187.47
country_id: 2017370
description:
Dec 19 00:32:21 host2 sshd[3576051]: Disconnected from invalid user usuario1 194.87.187.47 port 51610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 00:34:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<+v6doT5GEpU+PIMh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 00:35:19 host2 pure-ftpd[3577959]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.62.233.139
country_id: 3439705
description:
2025-12-19 00:36:56 dovecot_plain authenticator failed for r167-62-233-139.dialup.adsl.anteldata.net.uy (CHXEI8NX18) [167.62.233.139]:64955: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-19 00:37:54 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:59480: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-19 00:38:20 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:59800: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-19 00:38:41 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:49890: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-12-19 00:39:01 dovecot_login authenticator failed for ([103.186.193.149]) [103.186.193.149]:41464: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 00:41:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Kt9euT5GMOI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.188
country_id: 1694008
description:
2025-12-19 00:40:51 dovecot_login authenticator failed for (ADMIN) [188.214.125.188]:26651: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.37
country_id: 6252001
description:
Dec 19 00:43:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.37, lip=66.85.158.91, TLS handshaking: Connection closed, session=<67Z7wD5GF5RBMQEl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Dec 19 00:43:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rW6/wT5GCipBMQEY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-19 00:45:44 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:56934: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-19 00:46:09 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:40838: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 00:47:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<5lazzj5GorA+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 00:47:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<fXTz0D5GXMo+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 00:49:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<E1rr1j5G6Kg+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 00:50:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<N/ES2z5GIqg+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.180
country_id: 3017382
description:
Dec 19 00:50:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.180, lip=66.85.158.92, session=<NQi72T5GIcpbxJi0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.181
country_id: 3017382
description:
Dec 19 00:50:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.181, lip=66.85.158.92, session=<ZrTf2j5GJ8lbxJi1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 01:00:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<OWb4/T5GHOc+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 01:02:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<YaXvBD9GQK8+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-19 01:04:10 dovecot_login authenticator failed for ([125.20.249.192]) [27.123.113.10]:58486: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-19 01:03:41 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:47428: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 01:04:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<EEQiDj9GCNo+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 19 01:08:12 host2 sshd[3601803]: Disconnected from invalid user user 213.55.85.202 port 4426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.36
country_id: 617790
description:
2025-12-19 01:07:33 dovecot_login authenticator failed for (ADMIN) [178.175.129.36]:12604: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 19 01:07:47 host2 sshd[3601571]: Disconnected from invalid user myuser 163.44.173.168 port 44666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Dec 19 01:08:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, session=<IVe8HD9GzoVAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.83.211
country_id: 2750405
description:
Dec 19 01:09:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=134.209.83.211, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<I+iuHT9G3pyG0VPT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Dec 19 01:09:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, session=<OEVGHj9GYsBAPpyY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Dec 19 01:09:52 host2 sshd[3602938]: Disconnected from invalid user thor 194.107.115.11 port 41588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.173.168
country_id: 1861060
description:
Dec 19 01:11:04 host2 sshd[3604139]: Disconnected from invalid user felix 163.44.173.168 port 44450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 19 01:11:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<xmJNJT9GWLI+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Dec 19 01:11:41 host2 sshd[3604484]: Disconnected from invalid user localuser 194.107.115.11 port 21564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 19 01:13:47 host2 sshd[3606230]: Disconnected from invalid user yash 213.55.85.202 port 4428 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Dec 19 01:13:15 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.4, lip=66.85.158.92, TLS, session=<HuMELD9GaqLCpGsE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.55.85.202
country_id: 337996
description:
Dec 19 01:15:09 host2 sshd[3607199]: Disconnected from invalid user ftpuser 213.55.85.202 port 4430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 19 01:14:28 host2 sshd[3606685]: Disconnected from invalid user ahmad 213.55.85.202 port 4429 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 01:14:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<J4Q0MT9Gnug+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.55.85.202
country_id: 337996
description:
Dec 19 01:15:51 host2 sshd[3607571]: Disconnected from invalid user lara 213.55.85.202 port 4431 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 01:15:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<E5qfNT9GIKA+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-19 01:19:51 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (expines) [68.46.148.180]:40470: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 01:22:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ESJhTT9GgtM+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-19 01:22:45 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:43220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-19 01:26:06 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (alises) [73.195.211.98]:52320: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-19 01:25:57 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (sculotoose) [73.137.7.97]:37896: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 01:26:24 host2 sshd[3614530]: Disconnected from invalid user user 2.57.121.25 port 8292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 01:29:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<9kD2ZT9GqMs+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 19 01:30:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<Cbb3aT9G/OI+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-19 01:31:54 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:47380: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-19 01:31:26 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:35241: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 01:32:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<fN0gcj9GKOw+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 01:34:41 host2 sshd[3619431]: Disconnected from invalid user stone 62.60.131.157 port 7706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.200
country_id: 6252001
description:
2025-12-19 01:35:43 dovecot_login authenticator failed for (ADMIN) [181.214.166.200]:47348: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 01:36:22 host2 sshd[3621070]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 01:37:14 host2 pure-ftpd[3621585]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.113
country_id: 6252001
description:
Dec 19 01:39:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.113, lip=66.85.158.92, session=<m9eAiT9GhPTG6xhx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 01:43:08 host2 sshd[3625037]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-19 01:43:45 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (mobion) [66.177.30.53]:44000: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 19 01:46:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<kwkZoT9GnJk+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 01:46:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<o4Q5oj9GXrc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-19 01:50:51 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:55882: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-19 01:51:14 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:52083: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 01:54:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<i5IXvj9Gvq0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 01:53:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<O1MGuz9GopY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-19 01:54:47 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:43163: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-19 01:54:55 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (aminel) [73.195.211.98]:44874: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 19 01:54:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<6uqxvz9GfLvBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 01:56:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<WC8pxj9GNqI+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.35
country_id: 2963597
description:
2025-12-19 01:57:21 dovecot_login authenticator failed for (ADMIN) [155.2.194.35]:41539: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 19 01:56:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<yFwsxz9GQqE+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 01:58:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<tKBzzT9G/q4+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-19 01:59:33 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (menon) [73.137.7.97]:40772: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 19 02:03:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<51V/4D9GII8+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 19 02:04:25 host2 sshd[3640351]: Disconnected from invalid user znc-admin 198.12.75.220 port 60858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 02:06:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<czYJ6T9GaMw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 02:06:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<B+Wh6T9GWsY+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 19 02:05:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<l7Zt6D9GwDlChJl4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.59.3.214
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.59.3.214 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2025-12-19 02:07:56 dovecot_plain authenticator failed for (culowl) [94.254.244.211]:45167: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.219.163
country_id: 6252001
description:
Dec 19 02:08:19 host2 sshd[3642514]: Disconnected from invalid user znc-admin 144.126.219.163 port 60234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.111
country_id: 3865483
description:
Dec 19 02:09:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=179.0.251.111, lip=66.85.158.91, TLS, session=<qKKh8j9GCaazAPtv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 19 02:09:22 host2 sshd[3643178]: Disconnected from invalid user super 198.12.75.220 port 39572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.130.216
country_id: 690791
description:
Dec 19 02:08:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=37.221.130.216, lip=66.85.158.91, TLS, session=<SVxt8T9GUYIl3YLY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 19 02:10:06 host2 sshd[3643692]: Disconnected from invalid user admin 198.12.75.220 port 49424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.126.219.163
country_id: 6252001
description:
Dec 19 02:09:36 host2 sshd[3643257]: Disconnected from invalid user desarrollo 144.126.219.163 port 43060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 02:09:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<E61/9j9GJo4+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-19 02:09:58 dovecot_login authenticator failed for (H7XsAl) [178.16.54.97]:50948: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-19 02:10:49 dovecot_login authenticator failed for (we9UnPlXY) [178.16.54.97]:59519: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 19 02:10:50 host2 sshd[3644138]: Disconnected from invalid user rabbitmq 198.12.75.220 port 34900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.126.219.163
country_id: 6252001
description:
Dec 19 02:11:17 host2 sshd[3644432]: Disconnected from invalid user yann 144.126.219.163 port 44700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-19 02:11:59 dovecot_login authenticator failed for (m4YHJdJ) [178.16.54.97]:62430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.24.185.98
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 217.24.185.98 - info@sysnytech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2025-12-19 02:14:58 dovecot_plain authenticator failed for c-73-188-252-208.hsd1.pa.comcast.net (carnic) [73.188.252.208]:44712: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-19 02:15:01 dovecot_plain authenticator failed for (skyans) [64.72.74.162]:37903: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 02:15:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<UmTrCEBGdpQ+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.18.56
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.144.18.56 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 02:16:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=</YM9D0BGqsI+PIMp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.232.79.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.232.79.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.219.24.73
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 102.219.24.73 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.215.163.3
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 106.215.163.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.161.148.51
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.161.148.51 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.133
country_id: 1210997
description:
2025-12-19 02:19:24 dovecot_login authenticator failed for (ADMIN) [64.64.112.133]:15852: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Dec 19 02:18:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Df79FkBGRduTuYTw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.9.166
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.234.9.166 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 19 02:23:32 host2 sshd[3651777]: Disconnected from invalid user dspace 190.0.63.226 port 34820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.77.216.206
country_id: 3277605
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.77.216.206 - info "GET /login/?login_only=1&user=info&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 19 02:24:50 host2 sshd[3652803]: Disconnected from invalid user kitty 190.0.63.226 port 59072 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.100
country_id: 2635167
description:
Dec 19 02:24:55 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.100, lip=66.85.158.91, TLS, session=<k+xMLEBGn7+594lk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 19 02:25:30 host2 sshd[3653529]: Disconnected from invalid user soporte 189.217.130.86 port 6026 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.254.116
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.234.254.116 - ceylo "GET /login/?login_only=1&user=ceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.198.158.135
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.198.158.135 - ceyl "GET /login/?login_only=1&user=ceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.228.48.109
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.228.48.109 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.214.223.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.214.223.65 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.161.196.26
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 177.161.196.26 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.70.141.90
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.70.141.90 - ceylondiges "GET /login/?login_only=1&user=ceylondiges&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondiges (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.223.46.235
country_id: 1668284
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 61.223.46.235 - ceylondig "GET /login/?login_only=1&user=ceylondig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.48.188.238
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.48.188.238 - ceylondi "GET /login/?login_only=1&user=ceylondi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.139.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.138.139.152 - ceylond2 "GET /login/?login_only=1&user=ceylond2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-19 02:26:11 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:54989: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-19 02:26:16 dovecot_plain authenticator failed for (sation) [102.53.15.180]:57415: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 02:26:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<f5n+MUBG3MY+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.117.193.33
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.117.193.33 - ceylond "GET /login/?login_only=1&user=ceylond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-19 02:26:34 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:50466: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.169.183.34
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.169.183.34 - ceylondigest "GET /login/?login_only=1&user=ceylondigest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.106.46.254
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.106.46.254 - ceylondigestcom "GET /login/?login_only=1&user=ceylondigestcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondigestcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.79.182.68
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.79.182.68 - cey "GET /login/?login_only=1&user=cey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.13.115
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.117.13.115 - ceylondige "GET /login/?login_only=1&user=ceylondige&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondige (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-19 02:25:48 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:52916: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.222.237.6
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.222.237.6 - ceylon "GET /login/?login_only=1&user=ceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.133.213
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.190.133.213 - ceylond1 "GET /login/?login_only=1&user=ceylond1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond1 (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Dec 19 02:27:16 host2 sshd[3654745]: Disconnected from invalid user css 189.217.130.86 port 46765 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.162
country_id: 3469034
description:
Dec 19 02:27:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=191.53.129.162, lip=66.85.158.91, TLS, session=<3ww/NEBGNI+/NYGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.106
country_id: 226074
description:
Dec 19 02:27:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<marketing>, method=PLAIN, rip=196.0.107.106, lip=66.85.158.91, TLS, session=</g+MNUBGX+vEAGtq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 02:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<IOvlN0BGBpE+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 02:29:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<+QtbPEBGDow+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 02:33:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xhE/S0BGmI8+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 02:33:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<ukgMTEBGcLU+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 19 02:35:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<sE2VUUBG6OY+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-19 02:35:40 dovecot_plain authenticator failed for (suppene) [12.150.243.22]:45164: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-19 02:35:36 dovecot_plain authenticator failed for (nonony) [24.93.140.162]:51630: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-19 02:36:48 dovecot_plain authenticator failed for (matne) [192.34.128.202]:58922: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 02:39:27 host2 pure-ftpd[3663248]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 02:40:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<tHN7Y0BGaoE+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.47
country_id: 2542007
description:
2025-12-19 02:41:26 dovecot_login authenticator failed for (ADMIN) [95.181.232.47]:27632: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-19 02:45:08 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:56979: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-19 02:45:26 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:32792: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 02:49:08 host2 sshd[3670950]: Disconnected from invalid user admin 2.57.121.112 port 54933 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-19 02:49:22 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (enessninid) [68.82.141.145]:42966: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 02:51:58 host2 sshd[3672984]: Disconnected from invalid user arely 62.60.131.157 port 53348 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.52.236.158
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 152.52.236.158 - info@sivagnanamfoundation.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 02:57:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<gKacoEBGRJ8+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 19 02:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.92, session=<58lXpUBGMMtV2ZUJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-19 02:59:34 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (stive) [174.161.27.82]:51240: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-12-19 02:59:58 dovecot_plain authenticator failed for (unflut) [65.20.163.103]:51643: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.5
country_id: 3175395
description:
2025-12-19 03:02:01 dovecot_login authenticator failed for (ADMIN) [156.146.41.5]:47308: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.240.62
country_id: 1733045
description:
2025-12-19 03:03:06 dovecot_plain authenticator failed for ([31.57.166.48]) [27.125.240.62]:56115: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.240.47
country_id: 99237
description:
2025-12-19 03:03:19 dovecot_plain authenticator failed for ([31.57.166.48]) [62.201.240.47]:8457: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.147.247
country_id: 289688
description:
2025-12-19 03:03:32 dovecot_plain authenticator failed for ([31.57.166.48]) [37.211.147.247]:36194: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.147.247
country_id: 289688
description:
2025-12-19 03:03:38 dovecot_login authenticator failed for ([31.57.166.48]) [37.211.147.247]:36194: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-19 03:03:42 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (unishectal) [68.52.119.193]:38808: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-19 03:03:41 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (aditier) [76.145.10.140]:52246: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-19 03:03:58 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:59945: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 03:04:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yEdeukBGANE+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 03:06:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Msoiv0BGZuQ+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 03:06:50 host2 sshd[3684849]: Disconnected from invalid user admin 2.57.121.112 port 40783 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 19 03:07:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<p0itxEBGULw+PIcr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.250.191.33
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.250.191.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 03:11:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<gFFC00BGKrw+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 03:15:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<FR4P4kBGNL4+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 03:17:55 host2 sshd[3691566]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-19 03:18:56 dovecot_plain authenticator failed for (laboo) [65.20.133.208]:36192: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 03:22:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<uvJP+UBGRJE+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 03:24:38 host2 sshd[3695676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 19 03:24:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<RX72AUFGosE+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.154.134.41
country_id: 3658394
description:
2025-12-19 03:26:17 dovecot_plain authenticator failed for ([31.57.166.48]) [190.154.134.41]:35624: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.188.123.22
country_id: 290291
description:
2025-12-19 03:26:30 dovecot_plain authenticator failed for ([31.57.166.48]) [193.188.123.22]:46634: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.188.123.22
country_id: 290291
description:
2025-12-19 03:26:37 dovecot_login authenticator failed for ([31.57.166.48]) [193.188.123.22]:46634: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.138
country_id: 1562822
description:
2025-12-19 03:27:21 dovecot_login authenticator failed for (ADMIN) [173.239.247.138]:34925: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-19 03:33:44 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:55936: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2025-12-19 03:34:02 dovecot_login authenticator failed for a088.broadband.quicknet.se [217.78.16.88]:41048: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-19 03:34:25 dovecot_login authenticator failed for ([62.97.170.54]) [62.97.170.54]:52340: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-19 03:34:35 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:51006: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-19 03:35:45 dovecot_plain authenticator failed for (droupes) [38.248.111.238]:44196: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 19 03:41:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<GoxiP0FGiII+PIdh>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 03:41:36 host2 pure-ftpd[3705733]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2025-12-19 03:42:52 dovecot_plain authenticator failed for c-73-188-252-208.hsd1.pa.comcast.net (excortur) [73.188.252.208]:36872: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-19 03:49:27 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:58278: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-19 03:50:01 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:37578: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-19 03:50:21 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:40607: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.134
country_id: 6252001
description:
2025-12-19 03:50:43 dovecot_login authenticator failed for ([98.185.120.134]) [98.185.120.134]:41697: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.39
country_id: 6252001
description:
Dec 19 03:50:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NpC+X0FG59/N0h8n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-19 03:51:15 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:49862: 535 Incorrect authentication data (set_id=maximsholdings@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-12-19 03:51:36 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:41608: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-19 03:52:00 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:55566: 535 Incorrect authentication data (set_id=maximsholdings)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-19 03:52:50 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:40191: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 19 03:53:03 host2 sshd[3716118]: Disconnected from invalid user vintagestory 38.248.12.102 port 50256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 19 03:53:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.51, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hDGCaUFG3MnN0h8z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 19 03:53:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<tPAAakFGOJ4+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-19 03:55:50 dovecot_plain authenticator failed for (idism) [91.73.188.251]:56966: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.135
country_id: 1694008
description:
2025-12-19 03:56:27 dovecot_login authenticator failed for (ADMIN) [188.214.125.135]:47576: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-19 03:58:17 dovecot_plain authenticator failed for (unpaltuat) [65.20.143.159]:43334: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Dec 19 04:04:30 host2 sshd[3724831]: Disconnected from invalid user user1 87.201.127.149 port 60624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 04:05:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Kz6BlEFGHuk+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Dec 19 04:05:56 host2 sshd[3725869]: Disconnected from invalid user cc 87.201.127.149 port 58704 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.201.127.149
country_id: 290557
description:
Dec 19 04:06:36 host2 sshd[3726394]: Disconnected from invalid user wg 87.201.127.149 port 43626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 04:06:46 host2 sshd[3726457]: Disconnected from invalid user user 2.57.121.25 port 8251 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.22
country_id: 6252001
description:
Dec 19 04:10:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PJAApkFG+t+TuYQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-19 04:11:04 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:60281: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-19 04:11:45 dovecot_login authenticator failed for (nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:42084: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-19 04:16:17 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:20062: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-19 04:16:34 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:49522: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-19 04:16:38 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:9070: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-19 04:16:55 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:35924: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-19 04:17:27 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:55946: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-19 04:17:44 dovecot_login authenticator failed for ([84.214.63.110]) [84.214.63.110]:34465: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2025-12-19 04:22:45 dovecot_plain authenticator failed for (unies) [41.65.118.172]:49784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.201.57.102
country_id: 6252001
description:
[2025-12-19 04:23:36 +0530] info [webmaild] 67.201.57.102 - info@simple-engineering.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@simple-engineering.lk has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 04:23:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<vipr1UFG2Ko+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-19 04:27:00 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:59432: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 04:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<pUoQ4UFGsIc+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.185
country_id: 3144096
description:
2025-12-19 04:27:19 dovecot_login authenticator failed for (cm-84.215.111.185.get.no) [84.215.111.185]:42780: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 19 04:29:28 host2 sshd[3740180]: Disconnected from invalid user abc 84.51.43.58 port 34383 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 19 04:30:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<a3nJ7EFGlII+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 19 04:30:51 host2 sshd[3741412]: Disconnected from invalid user docker 84.51.43.58 port 58342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 04:32:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<cUk480FGNMQ+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 04:31:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<lEdV8EFGpLY+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 19 04:31:21 host2 sshd[3741980]: Disconnected from invalid user appuser 158.69.204.92 port 38562 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.51.43.58
country_id: 298795
description:
Dec 19 04:31:30 host2 sshd[3742254]: Disconnected from invalid user eyftpuser 84.51.43.58 port 54003 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-19 04:31:40 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:35926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-19 04:31:52 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:35330: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.162
country_id: 6252001
description:
Dec 19 04:33:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.162, lip=66.85.158.92, TLS, session=<kY2R9kFGAvHN0h+i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 19 04:34:52 host2 sshd[3745480]: Disconnected from invalid user ubuntu 152.32.129.236 port 54526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 19 04:36:11 host2 sshd[3746952]: Disconnected from invalid user testadmin 152.32.129.236 port 52182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 19 04:35:31 host2 sshd[3746303]: Disconnected from invalid user teamspeak 158.69.204.92 port 40332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec 19 04:35:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<ws1u/0FGjIdHBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 19 04:36:34 host2 sshd[3747433]: Disconnected from invalid user ubuntu 158.69.204.92 port 50870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 19 04:36:48 host2 sshd[3747630]: Disconnected from invalid user tester 152.32.129.236 port 57542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 19 04:37:23 host2 sshd[3748146]: Disconnected from invalid user alexis 152.32.129.236 port 47286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2025-12-19 04:39:13 dovecot_login authenticator failed for ([128.185.241.213]) [125.19.138.74]:38660: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-12-19 04:39:52 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:58162: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 04:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<PKF7D0JGOs4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 19 04:40:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<eawWEUJGtMM+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-19 04:42:28 dovecot_login authenticator failed for ([178.232.55.16]) [178.232.55.16]:34938: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-19 04:43:01 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:55732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 04:43:48 host2 pure-ftpd[3755044]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2025-12-19 04:43:21 dovecot_plain authenticator failed for (crines) [216.132.40.41]:38412: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-19 04:43:24 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:48927: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-19 04:44:51 dovecot_plain authenticator failed for (ambilatic) [178.250.191.189]:49632: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 19 04:44:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<abSlIEJGYtA+PIdq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.243
country_id: 6252001
description:
Dec 19 04:44:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.243, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ifm/H0JGJsjG6xjz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-19 04:46:42 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:60602: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-19 04:47:17 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:44870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.156.241
country_id: 294640
description:
2025-12-19 04:47:29 dovecot_login authenticator failed for ([80.250.156.241]) [80.250.156.241]:54646: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-19 04:47:40 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:36552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-19 04:48:05 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:39064: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 04:50:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uXvQNEJGPsU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 04:54:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<CS3NQ0JGQII+PIMh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 04:59:05 host2 sshd[3771357]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-19 05:00:01 dovecot_login authenticator failed for (FKmFdGx) [65.52.218.176]:53025: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-19 05:00:18 dovecot_login authenticator failed for (VMKC20O) [65.52.218.176]:53247: 535 Incorrect authentication data (set_id=ajith)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 65.52.218.176
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[65.52.218.176] [Authentication Database]=[mail] [Username]=[ajith] (5/5 failures) (blocked until [Thu Dec 18 23:45:51 2025 UTC/Fri Dec 19 05:15:51 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-19 05:01:57 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (fasode) [73.129.57.71]:51562: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-19 05:02:03 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (beadic) [71.230.228.16]:40718: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 05:02:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<cXZ6X0JGiOY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.52.218.176
country_id: 6252001
description:
2025-12-19 05:03:53 dovecot_login authenticator failed for (i52yKP) [65.52.218.176]:54515: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 05:04:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<F1F3aEJGtMw+PIce>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 05:05:57 host2 sshd[3778867]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 05:07:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<vFf7ckJG0IM+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 05:07:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<UN9Rc0JGIsI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 05:10:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<63HXe0JGmMU+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 05:11:51 host2 sshd[3782773]: Disconnected from invalid user kaia 62.60.131.157 port 8673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-19 05:11:59 dovecot_plain authenticator failed for (baubiont) [64.72.74.162]:57876: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.230
country_id: 6252001
description:
Dec 19 05:13:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.230, lip=66.85.158.91, TLS, session=<2WmohkJGEPnN0h/m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 05:14:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ihvWi0JGIpU+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 05:19:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<7scNnUJGwtM+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 05:22:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<28BipkJGFN0+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-19 05:22:41 dovecot_plain authenticator failed for (kruip) [94.201.22.158]:38286: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.138.21
country_id: 6252001
description:
Dec 19 05:23:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.138.21, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<O4kDqkJGRNEUQYoV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 05:23:42 host2 sshd[3790689]: Disconnected from invalid user misty 62.60.131.157 port 36777 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-19 05:26:00 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:47763: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-19 05:26:06 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (quanish) [67.172.54.29]:57058: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 05:26:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<WhVntEJG5o4+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.227.136.237
country_id: 6252001
description:
2025-12-19 05:26:17 dovecot_login authenticator failed for (syn-072-227-136-237.res.spectrum.com) [72.227.136.237]:41896: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec 19 05:27:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=147.185.132.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<twC0t0JGeN2TuYQw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 05:28:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<DchUu0JGXK0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-19 05:28:30 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:46054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-19 05:28:49 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:42494: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 05:29:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<KzNTv0JGfL0+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 05:29:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<FflOwUJGUJU+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-19 05:29:29 dovecot_plain authenticator failed for (mulaxia) [65.20.164.137]:54219: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-19 05:33:55 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (erdiative) [73.197.236.163]:47626: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 19 05:36:16 host2 sshd[3798765]: Disconnected from invalid user ubuntu 138.248.168.20 port 48908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.33.221
country_id: 6252001
description:
Dec 19 05:37:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.33.221, lip=66.85.158.91, session=<PvRw3kJGKKEUoyHd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.114.112
country_id: 3175395
description:
Dec 19 05:39:05 host2 sshd[3800899]: Disconnected from invalid user test 151.35.114.112 port 56057 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 19 05:38:31 host2 sshd[3800570]: Disconnected from invalid user Admin 138.248.168.20 port 54642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.161.144.124
country_id: 2300660
description:
2025-12-19 05:39:20 dovecot_plain authenticator failed for (Q3OS5) [154.161.144.124]:27136: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.119.147.213
country_id: 6252001
description:
[2025-12-19 05:39:26 +0530] info [webmaild] 74.119.147.213 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 19 05:40:16 host2 sshd[3801610]: Disconnected from invalid user git 96.44.159.120 port 57772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 19 05:40:24 host2 sshd[3801706]: Disconnected from invalid user gts 144.31.195.14 port 56490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.91.107.7
country_id: 6252001
description:
Dec 19 05:40:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.91.107.7, lip=66.85.158.92, session=<O7B950JGJpGKW2sH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 19 05:42:09 host2 sshd[3802728]: Disconnected from invalid user home 96.44.159.120 port 36808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-19 05:41:37 dovecot_plain authenticator failed for (verming) [182.75.215.245]:57454: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.114.112
country_id: 3175395
description:
Dec 19 05:43:53 host2 sshd[3803544]: Disconnected from invalid user teamspeak3 151.35.114.112 port 56316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 19 05:45:00 host2 sshd[3804607]: Disconnected from invalid user web 144.31.195.14 port 36220 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 05:46:05 host2 pure-ftpd[3805314]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 19 05:45:34 host2 sshd[3805050]: Disconnected from invalid user user 144.31.195.14 port 47752 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-19 05:47:06 dovecot_plain authenticator failed for (pokulphyon) [199.192.123.12]:35690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 19 05:46:36 host2 sshd[3805521]: Disconnected from invalid user wp 144.31.195.14 port 48116 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.127.14
country_id: 6252001
description:
Dec 19 05:47:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.127.14, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cNQMAkNG2JOH7X8O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.227
country_id: 6252001
description:
Dec 19 05:50:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.227, lip=66.85.158.91, TLS, session=<+mHVC0NGyubN0h/j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 05:51:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<HkCuEENG2Kw+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-19 05:52:27 dovecot_plain authenticator failed for (hexurd) [65.20.160.107]:51481: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 05:54:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<fQeqGUNGDMg+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-19 05:59:29 dovecot_plain authenticator failed for (hutendolly) [64.72.74.162]:45448: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 06:01:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<0wFGNENGZLQ+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 06:02:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<dYOwNENGvoQ+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.181.155
country_id: 3175395
description:
Dec 19 06:02:44 host2 sshd[3815329]: Disconnected from invalid user ftpuser 151.44.181.155 port 56192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.181.155
country_id: 3175395
description:
Dec 19 06:04:08 host2 sshd[3816465]: Disconnected from invalid user teamspeak3 151.44.181.155 port 56998 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.7
country_id: 798549
description:
Dec 19 06:04:47 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=212.73.148.7, lip=66.85.158.91, session=<NW2WPkNG1oPUSZQH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.181.155
country_id: 3175395
description:
Dec 19 06:04:56 host2 sshd[3816860]: Disconnected from invalid user deploy 151.44.181.155 port 56918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-19 06:06:11 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (arock) [98.204.134.124]:34012: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 06:05:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obiss) [87.103.126.54]:48172: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 19 06:06:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NhlFRUNGcLdChJmA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 06:09:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Mn8MUUNGDLo+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2025-12-19 06:11:43 dovecot_plain authenticator failed for (tualms) [73.85.44.247]:45126: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.93.68.178
country_id: 3469034
description:
Dec 19 06:13:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.93.68.178, lip=66.85.158.91, session=<pAjhXUNGuNe7XUSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.56.0.19
country_id: 3469034
description:
Dec 19 06:13:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=189.56.0.19, lip=66.85.158.91, session=<iy7iXENGA9i9OAAT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.228.253
country_id: 1269750
description:
Dec 19 06:14:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=122.187.228.253, lip=66.85.158.91, session=<wo7AYENGOq96u+T9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.255.234.87
country_id: 130758
description:
Dec 19 06:14:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=37.255.234.87, lip=66.85.158.91, session=<hAg4YENGrJEl/+pX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-19 06:15:35 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (prinonia) [81.225.30.107]:54386: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 06:18:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<IZHWbUNGmOI+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-19 06:20:00 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (ubovers) [73.183.74.177]:34358: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.127
country_id: 6252001
description:
Dec 19 06:22:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.127, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wgR0fkNG4NzG6xh/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 06:23:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<sg5ngENGXuo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 06:38:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<gHshtkNGKKo+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 06:38:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<0wB4uENGct4+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 06:39:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<G9MLvENGaNA+PIdl>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 19 06:43:23 host2 sshd[3841735]: error: maximum authentication attempts exceeded for root from 70.184.117.114 port 45702 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 19 06:43:23 host2 sshd[3841735]: Disconnecting authenticating user root 70.184.117.114 port 45702: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 19 06:43:29 host2 sshd[3841787]: Disconnecting invalid user admin 70.184.117.114 port 45728: Too many authentication failures [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 06:48:26 host2 pure-ftpd[3845293]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 06:56:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<Hnce90NGgIg+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.99
country_id: 6252001
description:
Dec 19 07:01:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<StEECURGANHG6xhj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-19 07:01:48 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:44404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-12-19 07:02:00 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:56506: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 19 07:03:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<bc/1DkRGINc+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 07:04:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ukvFFERG+rE+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-19 07:06:52 dovecot_plain authenticator failed for (eplar) [65.20.148.165]:34716: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 07:09:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<2QqFJURG3JM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 07:12:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<1u1LL0RGOpE+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 07:14:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (relike) [87.103.126.54]:29458: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-19 07:15:32 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:39196: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-19 07:15:50 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (azing) [85.225.19.144]:50323: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-19 07:16:09 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:54596: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.156.66
country_id: 3017382
description:
Dec 19 07:16:23 host2 sshd[3864061]: Disconnected from invalid user db2admin 38.242.156.66 port 44542 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.242.156.66
country_id: 3017382
description:
Dec 19 07:17:11 host2 sshd[3864617]: Disconnected from invalid user csczserver 38.242.156.66 port 54164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.242.156.66
country_id: 3017382
description:
Dec 19 07:18:30 host2 sshd[3865206]: Disconnected from invalid user elle 38.242.156.66 port 36220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 19 07:20:53 host2 sshd[3866486]: Disconnected from invalid user www-data 85.18.236.229 port 59732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 07:21:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<nxN7UURG/NA+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 19 07:22:44 host2 sshd[3867545]: Disconnected from invalid user openvpn 209.141.52.88 port 35272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 19 07:23:35 host2 sshd[3868055]: Disconnected from invalid user almacen 85.18.236.229 port 57380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 19 07:24:48 host2 sshd[3868656]: Disconnected from invalid user wk 103.215.80.173 port 57748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Dec 19 07:25:04 host2 sshd[3868912]: Disconnected from invalid user admin 85.18.236.229 port 37172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 19 07:25:35 host2 sshd[3869183]: Disconnected from invalid user hik 209.141.52.88 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 19 07:25:55 host2 sshd[3869322]: Disconnected from invalid user almacen 167.172.85.65 port 57962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 19 07:26:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Iqh3YURGuMDBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-19 07:26:24 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:58018: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 19 07:26:26 host2 sshd[3869666]: Disconnected from invalid user zahar 209.141.52.88 port 34528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-19 07:26:10 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:38654: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Dec 19 07:27:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<l4NuZURGyJ5HBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.125.233.59
country_id: 2921044
description:
Dec 19 07:28:34 host2 sshd[3870753]: Disconnected from invalid user admin1 135.125.233.59 port 48228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 19 07:28:56 host2 sshd[3870909]: Disconnected from invalid user dev 167.172.85.65 port 36596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 07:29:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<0usjbERGRs8+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 19 07:28:13 host2 sshd[3870584]: Disconnected from invalid user ubuntu 209.141.52.88 port 34156 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 135.125.233.59
country_id: 2921044
description:
Dec 19 07:29:59 host2 sshd[3871400]: Received disconnect from 135.125.233.59 port 47622:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 07:30:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<u/d0cERG7pU+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.125.233.59
country_id: 2921044
description:
Dec 19 07:30:26 host2 sshd[3871872]: Disconnected from invalid user automation 135.125.233.59 port 46804 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Dec 19 07:31:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YeLadERGshBKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-19 07:33:31 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (fouried) [68.82.141.145]:46486: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 07:34:50 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS, session=<Kr2ogERGntLPWvQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 19 07:34:44 host2 sshd[3873986]: Disconnected from invalid user ubuntu 103.215.80.173 port 52270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 07:34:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<2yu9gERGWpHPWvQc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 07:35:33 host2 sshd[3874612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 07:38:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<aaGwjkRGJo8+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 07:39:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<iALvkkRGSJU+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 07:41:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<2RMKmURGKOo+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 07:44:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Go+dpERGeuU+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-19 07:46:05 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:35226: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 07:46:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<JmDeqERGMtY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-19 07:49:54 dovecot_login authenticator failed for ([182.95.197.193]) [182.79.87.18]:41154: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 19 07:49:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<C2KmtERGxNI+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-19 07:50:14 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:47798: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 07:50:44 host2 pure-ftpd[3884020]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 19 07:52:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<fKpewERG9uM+PIdg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 07:53:58 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<CYURxURGUrsDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.165.208.12
country_id: 2077456
description:
2025-12-19 07:54:05 dovecot_login authenticator failed for (cpe-101-165-208-12.vb08.vic.asp.telstra.net) [101.165.208.12]:53786: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-12-19 07:54:31 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12061: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 07:54:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<o03mx0RGrtA+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 07:56:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<rTQKzURG8L4+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 07:56:13 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<YYsnzURGxrMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 07:57:40 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<yfJM0kRGesADhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 211.23.199.151
country_id: 1668284
description:
[2025-12-19 07:58:58 +0530] info [webmaild] 211.23.199.151 - info@askinternationalconsortium.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 19 07:58:16 host2 sshd[3888880]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 52511


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-19 07:58:47 dovecot_login authenticator failed for ([84.213.191.100]) [84.213.191.100]:42602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-19 07:59:22 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:55528: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 07:59:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<nMd/2URGjMcDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 08:00:00 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<j56u2kRG+qYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 19 08:01:05 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<em+L3kRGhqgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 08:17:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=</DY0GkVGjNQ+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 08:19:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=</HTWIUVGCNk+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.34
country_id: 6252001
description:
Dec 19 08:20:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=18.97.5.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hH9lIkVGcqQSYQUi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-19 08:22:04 dovecot_plain authenticator failed for (sychakety) [5.32.22.218]:59928: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 08:22:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<iCk8KUVG6Nc+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 08:23:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<IIfdL0VGku0+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-12-19 08:24:20 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:52520: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.127.24.165
country_id: 6252001
description:
2025-12-19 08:24:36 dovecot_login authenticator failed for 99-127-24-165.lightspeed.chrlnc.sbcglobal.net [99.127.24.165]:44416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 08:25:40 host2 sshd[3908129]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-19 08:25:25 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (toxist) [98.203.34.136]:33208: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 08:29:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uHpsRUVGxLQ+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-19 08:31:41 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (cometatosm) [73.53.254.168]:34966: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 19 08:31:53 host2 sshd[3912387]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 56071


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-19 08:32:20 dovecot_plain authenticator failed for (polly) [65.20.129.28]:35899: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 08:33:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<j9tSUkVGpLw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 19 08:33:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, session=<KApnU0VGrrlV2YwD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Dec 19 08:34:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7g0IVUVGEtgjy9Oh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 19 08:34:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<bFHfVUVGMO0+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Dec 19 08:35:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 25 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<NXPxWEVGzvojy9Oh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-19 08:37:55 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (stral) [73.195.211.98]:45976: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 08:39:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<RJx2ZkVGNMU+PIde>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 08:39:24 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS, session=<xBKLZ0VGnMbPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 08:39:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<UaSiZ0VGnsbPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-19 08:40:25 dovecot_login authenticator failed for ([187.8.120.90]) [187.8.120.90]:56336: 535 Incorrect authentication data (set_id=enveng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-12-19 08:40:36 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:59720: 535 Incorrect authentication data (set_id=enveng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-19 08:40:38 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:54258: 535 Incorrect authentication data (set_id=engenv@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-19 08:40:42 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:57290: 535 Incorrect authentication data (set_id=env.eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-19 08:40:49 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=engenv)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-19 08:40:56 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:42182: 535 Incorrect authentication data (set_id=eng_env@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-19 08:40:20 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:14865: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 08:42:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<jMUjcUVGiLU+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-12-19 08:41:20 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:52568: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-12-19 08:41:20 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:54008: 535 Incorrect authentication data (set_id=env-eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-19 08:41:22 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:35922: 535 Incorrect authentication data (set_id=env.eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Dec 19 08:41:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS, session=<b0v+b0VGVPUjy9Oh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-19 08:41:57 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:38303: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.161
country_id: 2635167
description:
Dec 19 08:42:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.161, lip=66.85.158.91, TLS, session=<pNN4c0VGyuAjy9Oh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 19 08:48:09 host2 sshd[3923667]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 49812


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 08:50:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<aj+ij0VGApw+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 08:52:55 host2 pure-ftpd[3926162]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-19 08:58:40 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:51186: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.117.199.59
country_id: 433561
description:
2025-12-19 08:59:08 dovecot_login authenticator failed for ([154.117.199.59]) [154.117.199.59]:59898: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-19 09:02:07 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:58346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-19 09:02:39 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:42448: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 09:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<DsyDwEVGWKU+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 09:05:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Qkt7w0VGys8+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.110
country_id: 6252001
description:
Dec 19 09:15:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.133.110, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hWnh6UVG99OTuYVu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.110
country_id: 6252001
description:
Dec 19 09:16:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.110, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fpNL7UVGXPaTuYVu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 09:20:07 host2 sshd[3942901]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-19 09:19:49 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:46316: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-19 09:20:26 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:55320: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 09:21:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<QILi/EVGYIw+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 19 09:21:32 host2 sshd[3943626]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 57062


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.110
country_id: 6252001
description:
Dec 19 09:22:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.110, lip=66.85.158.91, TLS, session=<3cxPAkZGYPaTuYVu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 09:28:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<n8yZF0ZG9Jc+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:29:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jmOiGUZGcJYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:30:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<69cEIEZGLpADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:32:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+/lEJUZGDqoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:33:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<y36PKEZG/IwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:34:16 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<IjTDK0ZGupMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.164.211.166
country_id: 1269750
description:
2025-12-19 09:34:35 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [103.164.211.166]:59721: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:35:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8wl6MEZGXKMDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 19 09:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=</a6uM0ZGnLI+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:36:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jQsGNEZGeuoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:37:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pBqXN0ZGGNUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:38:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6Q0/OkZGzIcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 09:39:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<aS1qPUZG0pADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 09:40:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<r4qDQ0ZGbpU+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 09:43:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<xxUYTEZGyL8+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 09:43:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<E+XyTUZGXpQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-19 09:46:42 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (press) [73.137.7.97]:55982: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 09:47:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (surkerly) [87.103.126.54]:27143: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 09:53:11 host2 pure-ftpd[3962732]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 09:56:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<dlR8e0ZG6Ig+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 19 09:58:06 host2 sshd[3965927]: Disconnected from invalid user test 51.222.106.104 port 56282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 09:58:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uH1UgUZGRKg+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.50.117
country_id: 3996063
description:
Dec 19 09:59:05 host2 sshd[3966416]: Disconnected from invalid user hadoop 189.178.50.117 port 51360 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.233
country_id: 6252001
description:
Dec 19 10:00:14 host2 pure-ftpd[3967203]: (?@198.235.24.233) [INFO] New connection from 198.235.24.233


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.50.117
country_id: 3996063
description:
Dec 19 10:00:22 host2 sshd[3967307]: Disconnected from invalid user deploy 189.178.50.117 port 47308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.50.117
country_id: 3996063
description:
Dec 19 10:00:57 host2 sshd[3967586]: Disconnected from invalid user ddd 189.178.50.117 port 59500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 19 10:02:38 host2 sshd[3968693]: Disconnected from invalid user test 103.250.10.42 port 54632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Dec 19 10:04:24 host2 sshd[3970335]: Disconnected from invalid user xiao 62.3.56.187 port 39094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 19 10:04:38 host2 sshd[3970484]: Disconnected from invalid user test 103.250.10.42 port 34792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 19 10:04:48 host2 sshd[3970587]: Disconnected from invalid user xiao 51.222.106.104 port 54044 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Dec 19 10:04:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.212, lip=66.85.158.92, TLS, session=<s9tomUZG2vPG6xjU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 19 10:05:18 host2 sshd[3971038]: Disconnected from invalid user zl 51.222.106.104 port 44508 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 189.178.50.117
country_id: 3996063
description:
Dec 19 10:05:21 host2 sshd[3971056]: Received disconnect from 189.178.50.117 port 43162:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 19 10:05:50 host2 sshd[3971336]: Disconnected from invalid user deploy 103.250.10.42 port 50978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 10:08:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<qOnZpEZGZOc+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.50.117
country_id: 3996063
description:
Dec 19 10:07:38 host2 sshd[3972528]: Disconnected from invalid user kp 189.178.50.117 port 34730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.42
country_id: 1643084
description:
Dec 19 10:07:41 host2 sshd[3972549]: Disconnected from invalid user db2 103.250.10.42 port 53920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-19 10:07:51 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (moger) [185.62.224.44]:32792: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 19 10:08:35 host2 sshd[3973077]: Disconnected from invalid user hadoop 51.222.106.104 port 45124 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 10:10:18 host2 sshd[3974301]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 19 10:10:48 host2 sshd[3974595]: Disconnected from invalid user ftpuser 185.216.116.13 port 59370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 19 10:14:14 host2 sshd[3977276]: Disconnected from invalid user ubuntu 185.216.116.13 port 59402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-19 10:14:46 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (complued) [76.145.10.140]:35516: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-19 10:15:37 dovecot_login authenticator failed for (dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:38616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-19 10:16:06 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:52370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 10:16:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<EhMgwkZGeNY+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-19 10:16:42 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:60512: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-19 10:17:22 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:59954: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-19 10:17:36 dovecot_login authenticator failed for ([178.150.135.19]) [178.150.135.19]:57016: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-19 10:18:37 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (tscal) [73.137.7.97]:56378: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 10:19:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<xfFpzkZGYpo+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 10:20:05 host2 sshd[3980827]: Disconnected from invalid user trisha 62.60.131.157 port 54688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-19 10:21:58 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (ankish) [196.47.172.253]:44267: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 19 10:22:51 host2 sshd[3982478]: Disconnected from invalid user test 70.54.182.130 port 54181 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.94
country_id: 6252001
description:
Dec 19 10:23:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TIxs3UZGMqoSYQVe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 19 10:25:04 host2 sshd[3983857]: Disconnected from invalid user xiao 70.54.182.130 port 59414 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.185.2.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 184.185.2.1 - info@agentallianz.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@agentallianz.com has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-19 10:28:05 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:58486: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-19 10:28:32 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:35447: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 10:34:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<k4o5A0dGdqI+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.245
country_id: 2635167
description:
Dec 19 10:34:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.210.245, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3DplBEdGf9Qjy9L1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 10:34:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4gG5BEdGBL8+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-12-19 10:35:52 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:41236: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.245
country_id: 2635167
description:
Dec 19 10:35:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.245, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<g5hjCEdGjPMjy9L1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.245
country_id: 2635167
description:
Dec 19 10:36:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.245, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<EDLFCUdGOv0jy9L1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-19 10:36:25 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:49498: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 10:37:33 host2 sshd[3991374]: Disconnected from invalid user user 2.57.121.25 port 50217 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.146.223
country_id: 1269750
description:
2025-12-19 10:37:53 dovecot_login authenticator failed for (solitude.engreensolutions.com.) [61.2.146.223]:63019: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 10:37:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<kVViD0dGkNs+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 19 10:38:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.137, lip=66.85.158.92, session=<4KlFEkdGiIpAPsWJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 10:41:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<pbUcHEdGPoU+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 10:41:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<10euHUdGHNM+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.245
country_id: 2635167
description:
Dec 19 10:43:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.245, lip=66.85.158.92, TLS, session=<ZK5IIkdGPPkjy9L1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-19 10:45:08 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (comistism) [71.235.225.181]:53424: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-19 10:47:13 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (uncized) [98.203.34.136]:52508: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 10:49:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<dkhjOEdGDts+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 10:52:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<c47RQUdGuII+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 10:54:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EgVoS0dGILo+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 10:54:59 host2 pure-ftpd[4003046]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 10:57:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ZN66U0dGVI0+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 19 10:57:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<b0u2VEdGXKw+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 19 11:01:26 host2 sshd[4007890]: Disconnected from invalid user developer 185.121.0.2 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 11:04:07 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (dredia) [87.103.126.54]:35475: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 11:04:50 host2 sshd[4010745]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.140.118
country_id: 2802361
description:
Dec 19 11:05:36 host2 pure-ftpd[4011501]: (?@34.78.140.118) [INFO] New connection from 34.78.140.118


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 19 11:07:13 host2 sshd[4012545]: Disconnected from invalid user user 43.227.185.238 port 40740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 19 11:07:46 host2 sshd[4012969]: Disconnected from invalid user dev 20.255.62.58 port 58396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.2
country_id: 1220409
description:
Dec 19 11:08:19 host2 sshd[4013330]: Disconnected from invalid user ubuntu 185.121.0.2 port 58268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 19 11:08:29 host2 sshd[4013401]: Disconnected from invalid user ftpuser 20.255.62.58 port 57546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 19 11:08:34 host2 sshd[4013427]: Disconnected from invalid user admin 43.227.185.238 port 60806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-19 11:08:18 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (heldomawk) [68.52.119.193]:52424: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-19 11:09:23 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (panterry) [68.83.181.181]:59348: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 19 11:09:55 host2 sshd[4014172]: Disconnected from invalid user rustserver 43.227.185.238 port 56140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 19 11:09:58 host2 sshd[4014205]: Disconnected from invalid user ubuntu 20.255.62.58 port 56120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-19 11:10:17 dovecot_plain authenticator failed for (quilus) [38.248.111.238]:37979: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 19 11:11:27 host2 sshd[4015965]: Disconnected from invalid user user 20.255.62.58 port 59304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-19 11:11:12 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (unfreekki) [71.224.169.28]:36716: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 19 11:11:13 host2 sshd[4015764]: Disconnected from invalid user pon 43.227.185.238 port 52528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 19 11:17:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=</pYym0dGyqks3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-19 11:17:47 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:42761: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-19 11:17:26 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:34482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-19 11:19:09 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:49138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-12-19 11:19:35 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:59906: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 11:19:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<nXEVpUdGSLY+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 11:21:40 host2 sshd[4023774]: Disconnected from invalid user trisha 62.60.131.157 port 17571 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 11:22:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<46/ZrkdGwMw+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 11:24:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<qhlUtUdGHrI+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 11:24:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<QSeEtkdGLps+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 11:25:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<9zrit0dGRKU+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 11:34:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Dsl92UdGZIg+PIM0>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 19 11:38:49 host2 pure-ftpd[4036404]: (?@138.117.78.106) [WARNING] Authentication failed for user [ivan@epid.gov.lk]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 11:38:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<quK750dGWp8+PIcl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 19 11:38:42 host2 pure-ftpd[4036404]: (?@138.117.78.106) [INFO] New connection from 138.117.78.106


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 11:42:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<74dw9EdGBII+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-12-19 11:41:33 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:41684: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 11:41:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<BhRh80dGsMc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-19 11:44:14 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:52822: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-12-19 11:44:51 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:49190: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 11:45:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Ga2YAEhGhI0+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-19 11:50:03 dovecot_plain authenticator failed for (ahashlikes) [50.202.197.108]:36010: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-19 11:50:09 dovecot_plain authenticator failed for (actarpress) [65.20.129.28]:50226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 19 11:50:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<zy6NEUhGFMM+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.2
country_id: 798549
description:
Dec 19 11:49:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.2, lip=66.85.158.91, session=<MQFjD0hGlqlV2YwC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 11:50:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<tDGyEUhG6qo+PIcl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Dec 19 11:52:27 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.4, lip=66.85.158.92, TLS, session=<DqbyGUhGDLPLN4ME>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 11:55:09 host2 sshd[4051953]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 11:57:28 host2 pure-ftpd[4054045]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 19 12:02:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<xZhBP0hG4n5ChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 12:04:16 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (rophantere) [87.103.126.54]:45263: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-19 12:04:20 dovecot_plain authenticator failed for (subdenaing) [102.53.15.18]:60238: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 12:07:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<nsWHUEhGdtQ+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 12:08:46 host2 sshd[4064865]: Disconnected from invalid user admin 2.57.121.112 port 7712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 19 12:13:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<q/NdZEhGRKU+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-19 12:14:31 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:40008: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-19 12:14:45 dovecot_login authenticator failed for (static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:43584: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 12:15:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<8Pq3akhGHss+PIcl>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 19 12:16:58 host2 sshd[4072539]: Disconnecting authenticating user root 98.191.229.175 port 40716: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 19 12:16:58 host2 sshd[4072539]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 40716 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 19 12:17:02 host2 sshd[4072619]: error: maximum authentication attempts exceeded for invalid user admin from 98.191.229.175 port 41992 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 19 12:17:04 host2 sshd[4072651]: Disconnecting invalid user admin 98.191.229.175 port 42280: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.144.77.222
country_id: 6252001
description:
Dec 19 12:16:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.144.77.222, lip=66.85.158.92, TLS handshaking: Connection closed, session=<F/QIcEhG6qYDkE3e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.64
country_id: 6252001
description:
Dec 19 12:17:19 host2 pure-ftpd[4072905]: (?@198.235.24.64) [INFO] New connection from 198.235.24.64


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 19 12:18:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<VlEWd0hGUtM+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 19 12:20:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<Lo9kfUhGZIk+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 12:20:53 host2 sshd[4076453]: Disconnected from invalid user admin 2.57.121.112 port 40406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-19 12:22:15 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:43408: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-12-19 12:23:16 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:51908: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 12:29:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Vxi2nEhGvK0+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 19 12:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<RTUOqEhGaswDWgzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec 19 12:34:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9JeAsUhGQvpChJl/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-19 12:36:03 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (tapectioxy) [73.213.237.28]:34696: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-19 12:36:06 dovecot_plain authenticator failed for (midenes) [154.144.243.93]:54832: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 12:36:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<qL1YtkhG6Mw+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 12:41:58 host2 sshd[4093802]: Disconnected from invalid user dawn 62.60.131.157 port 40045 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 19 12:43:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, TLS, session=<1iKT0UhGJo8DWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-19 12:45:02 dovecot_plain authenticator failed for (arveyiness) [65.20.133.208]:49567: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-19 12:45:22 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (gandolve) [24.127.53.61]:47192: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-19 12:46:40 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:44379: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-19 12:47:04 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:36930: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 12:47:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<TmQD3khGUpE+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 12:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<RAyh40hGwq4+PIcg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 12:49:50 host2 sshd[4100024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.40.213
country_id: 1880251
description:
[2025-12-19 12:49:21 +0530] info [cpaneld] 159.223.40.213 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.209.145.9
country_id: 1512440
description:
Dec 19 12:49:23 host2 sshd[4099732]: Disconnecting authenticating user root 62.209.145.9 port 57378: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.209.145.9
country_id: 1512440
description:
Dec 19 12:49:23 host2 sshd[4099732]: error: maximum authentication attempts exceeded for root from 62.209.145.9 port 57378 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.209.145.9
country_id: 1512440
description:
Dec 19 12:49:46 host2 sshd[4099926]: Disconnecting invalid user admin 62.209.145.9 port 58804: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 12:51:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Gg5i7EhGjLI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 19 12:53:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<Xran80hG6tE+PIdi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 19 12:55:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<t8Zc+0hGeKiLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 12:56:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<i3xh/khGnqQ+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 12:58:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<nIzMB0lGFOc+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 12:59:50 host2 pure-ftpd[4108283]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-19 13:00:17 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (prose) [89.67.37.2]:40140: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-19 13:00:21 dovecot_plain authenticator failed for (frighs) [154.144.243.93]:40888: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 13:01:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<sc1TEklGMp4+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 19 13:04:19 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<2M8CG0lGPIQsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-19 13:07:32 dovecot_plain authenticator failed for (datolona) [64.72.74.162]:55271: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 13:10:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<JlvQMUlGjKs+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:10:55 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tOKWMklGDLMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-19 13:11:22 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (dippicams) [196.47.172.253]:51256: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:11:47 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<LbqyNUlGPuoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:13:39 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<c1NePElGOtUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:14:58 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<7vYYQUlGGNcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:15:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<yc/PQklGstoDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:15:29 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<72fjQklG6twDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:16:25 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<6vhCRklGUJgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:16:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ifI6RklGOJgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:17:19 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<OYF2SUlGsr0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 19 13:18:11 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<DreYTElGzN4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 19 13:18:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<0gf2TUlGxtDBHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 19 13:19:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<92ibUklG5u0D7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.160
country_id: 6252001
description:
Dec 19 13:21:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.160, lip=66.85.158.92, session=<v8wUWElGguEUQcKg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-19 13:22:10 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (snegian) [24.15.216.41]:60708: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 13:24:26 host2 sshd[4126557]: Disconnected from invalid user admin 2.57.121.112 port 26024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 19 13:31:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<lqr2fElGZt0+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-19 13:32:42 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:38522: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-12-19 13:33:03 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:54016: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 19 13:32:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<u1WNfklGfNM+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 13:36:27 host2 sshd[4134218]: Disconnected from invalid user admin 2.57.121.112 port 36493 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 19 13:37:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<Ls2BkUlGDN0+PIcc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 13:40:27 host2 sshd[4136907]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-19 13:40:26 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:60200: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-19 13:40:55 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:44240: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-19 13:41:22 dovecot_login authenticator failed for ([78.188.102.28]) [78.188.102.28]:56460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-19 13:41:42 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:54988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-19 13:42:08 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:57462: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-19 13:42:38 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:39324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 19 13:44:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, TLS handshaking: Connection closed, session=<STEmqUlGGiS4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 19 13:44:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, TLS handshaking: Connection closed, session=<F7NWqklGNJ+4affC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 13:47:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (preal) [87.103.126.54]:55845: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 13:47:45 host2 sshd[4141532]: Disconnected from invalid user elsa 62.60.131.157 port 15152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 13:48:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<5V+nuElGGKg+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-19 13:49:03 dovecot_plain authenticator failed for (beles) [88.207.210.23]:63581: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 19 13:57:07 host2 sshd[4148564]: Disconnected from invalid user manager 158.174.210.161 port 37412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-19 13:57:41 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (eezine) [73.0.235.30]:59232: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 19 13:58:55 host2 sshd[4149640]: Disconnected from invalid user postgres 158.174.210.161 port 16815 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Dec 19 13:59:37 host2 sshd[4150008]: Disconnected from invalid user azureuser 158.174.210.161 port 52016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 19 14:01:36 host2 sshd[4151221]: Disconnected from invalid user server 51.83.71.110 port 43132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 19 14:01:39 host2 sshd[4151247]: Disconnected from invalid user sujan 139.59.43.242 port 57000 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 14:02:23 host2 pure-ftpd[4151663]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 14:02:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Ky8960lG/pY+PIdj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 19 14:03:10 host2 sshd[4152186]: Disconnected from invalid user rp 186.248.197.77 port 8370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 19 14:03:43 host2 sshd[4152781]: Disconnected from invalid user student01 139.59.43.242 port 55056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 14:04:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<lOsc8klGvOs+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 14:04:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Rw4A80lG4o0+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Dec 19 14:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, TLS: Connection closed, session=<q0BE80lGhnRChJmD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 19 14:04:22 host2 sshd[4153169]: Disconnected from invalid user yusuf 139.59.43.242 port 47720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Dec 19 14:04:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RziS80lGGHVChJmD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 19 14:05:14 host2 sshd[4153826]: Disconnected from invalid user test 186.248.197.77 port 7321 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.43.242
country_id: 1269750
description:
Dec 19 14:05:35 host2 sshd[4154044]: Disconnected from invalid user gaurav 139.59.43.242 port 44926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 19 14:05:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GtIQ90lGmoFChJl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-19 14:06:34 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:59974: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 14:06:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<6hgp+klGLr4+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-19 14:06:58 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.117]:56232: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 19 14:07:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<qct2+0lGDJUs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-19 14:07:38 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:51337: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.1.132.111
country_id: 1819730
description:
Dec 19 14:08:39 host2 pure-ftpd[4156059]: (?@128.1.132.111) [INFO] New connection from 128.1.132.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-19 14:11:50 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:39905: 535 Incorrect authentication data (set_id=maximsholdings.com@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-19 14:12:23 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:50272: 535 Incorrect authentication data (set_id=maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-19 14:12:35 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:34595: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-19 14:13:05 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (unferr) [73.208.81.125]:37218: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-19 14:13:08 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (sylationon) [73.197.194.98]:45676: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-19 14:13:09 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:35342: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-19 14:17:34 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (shiless) [144.64.157.244]:56651: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.178.45
country_id: 6252001
description:
Dec 19 14:17:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.178.45, lip=66.85.158.91, session=<9n+NIUpGBMdK+bIt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 19 14:17:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Ox85IkpGguQ+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 19 14:18:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<KShQJUpG6LE+PIcq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.67
country_id: 2264397
description:
Dec 19 14:19:42 host2 pure-ftpd[4163695]: (?@109.105.210.67) [INFO] New connection from 109.105.210.67


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.68
country_id: 2264397
description:
Dec 19 14:19:43 host2 pure-ftpd[4163705]: (?@109.105.210.68) [INFO] New connection from 109.105.210.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.69
country_id: 2264397
description:
Dec 19 14:19:43 host2 pure-ftpd[4163712]: (?@109.105.210.69) [INFO] New connection from 109.105.210.69


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 14:19:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<YWb7J0pG0JM+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.70
country_id: 2264397
description:
Dec 19 14:19:42 host2 pure-ftpd[4163697]: (?@109.105.210.70) [INFO] New connection from 109.105.210.70


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 19 14:20:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, TLS, session=<O0PuLEpGsKIsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-19 14:21:47 dovecot_plain authenticator failed for 40.red-81-42-225.staticip.rima-tde.net (notinflay) [81.42.225.40]:49536: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-19 14:22:46 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:26824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-19 14:23:17 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:44972: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-19 14:23:52 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:59356: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-19 14:24:10 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:57278: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-19 14:26:06 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:19858: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 14:29:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<JVxgTEpGzok+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-19 14:31:46 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chipper) [81.225.30.107]:55924: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 14:34:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<vUXMW0pGarw+PIMh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 14:35:22 host2 sshd[4174518]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 19 14:38:16 host2 pure-ftpd[4176706]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 19 14:38:20 host2 pure-ftpd[4176747]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 14:39:30 host2 sshd[4177570]: Disconnected from invalid user admin 2.57.121.112 port 33716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 14:39:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<IuICcEpG1M4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 14:39:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<2VbBcEpGzqo+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 14:41:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<z29IdkpG2tE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-19 14:42:43 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (awlent) [66.177.30.53]:57766: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 14:43:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vpMRf0pGdr4+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-12-19 14:45:24 dovecot_plain authenticator failed for (batived) [65.20.129.67]:56675: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 14:44:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<rrWzgkpGUMo+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.81.114.229
country_id: 2017370
description:
Dec 19 14:47:34 host2 sshd[4182971]: Disconnected from invalid user ubuntu 95.81.114.229 port 43132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-19 14:48:23 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:36074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-19 14:48:01 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:36232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.28.132
country_id: 3175395
description:
Dec 19 14:49:51 host2 sshd[4184258]: Disconnected from invalid user ubuntu 151.43.28.132 port 60163 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.34.65
country_id: 1168579
description:
2025-12-19 14:51:01 dovecot_plain authenticator failed for (ZZ7H17CIG) [59.103.34.65]:51109: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 14:51:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<toHnmUpGcpM+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 19 14:53:14 host2 sshd[4186752]: Disconnected from invalid user ubuntu 51.38.98.14 port 47922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.81.114.229
country_id: 2017370
description:
Dec 19 14:53:40 host2 sshd[4187034]: Disconnected from invalid user dima 95.81.114.229 port 51582 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Dec 19 14:54:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.234, lip=66.85.158.91, session=<3l+4pEpGXO2TuYTq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 14:54:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<HHYcpkpGAIk+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.28.132
country_id: 3175395
description:
Dec 19 14:54:24 host2 sshd[4187808]: Disconnected from invalid user user1 151.43.28.132 port 60108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.5
country_id: 798549
description:
Dec 19 14:55:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.5, lip=66.85.158.92, session=<Nu8gqUpG3pVV2YwF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-19 14:55:50 dovecot_plain authenticator failed for (blanle) [65.20.160.107]:59921: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 19 14:56:26 host2 sshd[4189603]: Disconnected from invalid user dima 51.38.98.14 port 37090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 19 14:56:59 host2 sshd[4189930]: Disconnected from invalid user ubuntu 51.38.98.14 port 35118 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 19 14:58:04 host2 pure-ftpd[4190853]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-19 15:00:23 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (bragenized) [24.23.125.83]:49256: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.146.25.12
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.146.25.12 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-19 15:02:20 dovecot_plain authenticator failed for (rerrhity) [65.20.129.28]:43368: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 15:02:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oFkbwUpGxt0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-19 15:02:23 dovecot_plain authenticator failed for (popituite) [65.20.250.163]:57379: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 19 15:03:08 host2 sshd[479]: Disconnected from invalid user test 27.254.149.199 port 60688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Dec 19 15:03:43 host2 sshd[1454]: Disconnected from invalid user vboxuser 103.4.145.50 port 50864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 19 15:05:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<pIc3zEpGvLE+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 15:05:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<YmobzUpGzuM+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 19 15:05:50 host2 sshd[3261]: Disconnected from invalid user admin 27.254.149.199 port 52982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 19 15:06:27 host2 sshd[3701]: Disconnected from invalid user openwrt 27.254.149.199 port 37142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-19 15:07:07 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:33732: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-19 15:07:32 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:48588: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-19 15:07:38 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:56212: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-19 15:08:09 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:59824: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 19 15:08:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<xvE01kpGAro+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-19 15:08:20 dovecot_login authenticator failed for (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:43596: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 15:08:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<eyGP2EpG7tQ+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 15:09:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<xHqV20pGztQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-12-19 15:11:48 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:43246: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-19 15:11:15 dovecot_login authenticator failed for ([49.124.152.234]) [49.124.152.234]:49156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 798549
description:
Dec 19 15:12:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.27, lip=66.85.158.91, session=<PIOd40pGrr9V2ZUb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-19 15:13:58 dovecot_plain authenticator failed for (affri) [5.32.99.14]:56748: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-19 15:14:06 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:42236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-19 15:14:25 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:56514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-19 15:20:06 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:33844: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-19 15:20:40 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:56112: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2025-12-19 15:20:42 dovecot_login authenticator failed for host-148-170-156-248.public.eastlink.ca [148.170.156.248]:44530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 15:20:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ug/+AktGLIM+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-19 15:21:01 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:55428: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-19 15:21:59 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:52241: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-19 15:22:18 dovecot_login authenticator failed for ([122.185.22.73]) [182.78.64.150]:34650: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 15:25:58 host2 sshd[16611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-19 15:25:58 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (pailbibler) [68.40.189.43]:58912: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 15:28:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<j8sRIEtGtOw+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-19 15:30:19 dovecot_plain authenticator failed for (comalutze) [154.146.240.123]:49270: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.115.8.61
country_id: 2661886
description:
Dec 19 15:31:28 host2 sshd[20849]: Disconnected from invalid user sujan 82.115.8.61 port 42060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.107.192
country_id: 2233387
description:
Dec 19 15:31:58 host2 sshd[21084]: Disconnected from invalid user tiktok 102.208.107.192 port 44148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 19 15:32:42 host2 sshd[21599]: Disconnected from invalid user testuser 138.68.9.182 port 50026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 19 15:33:07 host2 sshd[21839]: Disconnected from invalid user manager 139.59.26.79 port 41650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 19 15:33:12 host2 sshd[21892]: Disconnected from invalid user azureuser 138.68.9.182 port 43546 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 19 15:33:43 host2 sshd[22144]: Disconnected from invalid user git 138.68.9.182 port 41060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 15:34:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<1FS7MktGvo4+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 19 15:33:58 host2 sshd[22268]: Disconnected from invalid user user 189.194.140.170 port 53620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.189.233.12
country_id: 2017370
description:
Dec 19 15:34:04 host2 sshd[22345]: Disconnected from invalid user xj 203.189.233.12 port 48064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 19 15:34:10 host2 sshd[22389]: Disconnected from invalid user yusuf 20.123.120.169 port 50794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 19 15:34:13 host2 sshd[22425]: Disconnected from invalid user sammy 138.68.9.182 port 45662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 19 15:35:09 host2 sshd[23114]: Disconnected from invalid user arjun 189.194.140.170 port 49820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 15:35:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<U8XnNUtGtIo+PIdj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.189.233.12
country_id: 2017370
description:
Dec 19 15:35:05 host2 sshd[23069]: Disconnected from invalid user yusuf 203.189.233.12 port 39296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-19 15:36:12 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:33074: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 19 15:36:29 host2 sshd[29929]: Disconnected from invalid user test 139.59.26.79 port 41004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-19 15:36:27 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:50356: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Dec 19 15:36:47 host2 sshd[31918]: Disconnected from invalid user nikola 122.155.0.205 port 62251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.37
country_id: 3923057
description:
Dec 19 15:36:51 host2 sshd[32744]: Disconnected from invalid user manager 190.181.27.37 port 34702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 19 15:36:54 host2 sshd[33240]: Disconnected from invalid user mis 189.194.140.170 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.208.107.192
country_id: 2233387
description:
Dec 19 15:36:58 host2 sshd[33234]: Disconnected from invalid user dev 102.208.107.192 port 40718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Dec 19 15:37:07 host2 sshd[34930]: Disconnected from invalid user server2 139.59.26.79 port 37442 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 15:38:32 host2 sshd[37094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.208.107.192
country_id: 2233387
description:
Dec 19 15:38:39 host2 sshd[37463]: Disconnected from invalid user gera 102.208.107.192 port 43714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Dec 19 15:38:07 host2 sshd[36939]: Disconnected from invalid user manuel 20.123.120.169 port 45248 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 15:39:04 host2 sshd[37686]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.167
country_id: 6252001
description:
Dec 19 15:40:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<NEucSktGiMcUQGmn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.116.117.33
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 199.116.117.33 - info@greentaraceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 15:41:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (diford) [87.103.126.54]:38485: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-19 15:42:19 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:56928: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-19 15:42:30 dovecot_login authenticator failed for ([84.210.151.158]) [84.210.151.158]:40606: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2025-12-19 15:43:08 dovecot_login authenticator failed for ([125.19.172.137]) [182.78.242.142]:49242: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-19 15:43:39 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:56060: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.198.19.18
country_id: 130758
description:
Dec 19 15:44:12 host2 sshd[41413]: Disconnected from invalid user miner 85.198.19.18 port 42688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-19 15:44:46 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (calable) [66.177.30.53]:51918: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 15:44:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<nOpYVktGFI4+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 19 15:45:21 host2 sshd[42172]: Disconnected from invalid user deployer 103.38.182.49 port 48934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 19 15:46:19 host2 sshd[42692]: Disconnected from invalid user sammy 103.38.182.49 port 33802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.198.158.57
country_id: 953987
description:
2025-12-19 15:46:48 dovecot_plain authenticator failed for (Q171B58071) [41.198.158.57]:18125: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 19 15:46:56 host2 sshd[42966]: Disconnected from invalid user nagiosuser 103.38.182.49 port 49164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.198.158.57
country_id: 953987
description:
2025-12-19 15:46:58 dovecot_login authenticator failed for (Q171B58071) [41.198.158.57]:18125: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.38.182.49
country_id: 1269750
description:
Dec 19 15:48:10 host2 sshd[43605]: Disconnected from invalid user ubuntu 103.38.182.49 port 34396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-19 15:50:07 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (schural) [95.229.5.248]:55242: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-19 15:51:37 dovecot_plain authenticator failed for (croly) [14.139.107.146]:50570: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-19 15:52:33 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:40901: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-19 15:52:47 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:46241: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-12-19 15:53:05 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:46121: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-19 15:53:40 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:55223: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-19 15:56:33 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:52418: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 15:56:14 host2 sshd[62834]: Disconnected from invalid user shayne 62.60.131.157 port 22478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-19 15:57:08 dovecot_login authenticator failed for ([2.196.202.17]) [2.196.202.17]:57204: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Dec 19 15:58:38 host2 sshd[64004]: Disconnected from invalid user lenovo 202.79.29.108 port 51772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Dec 19 15:59:19 host2 sshd[64503]: Disconnected from invalid user myappuser 202.79.29.108 port 38452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.31
country_id: 6252001
description:
Dec 19 16:00:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.31, lip=66.85.158.92, TLS, session=<QSEvkEtG9LwNWX0f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 16:00:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<roUZkktG3LU+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-19 16:03:52 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (nonarmor) [98.203.34.136]:37156: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-19 16:05:14 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:58265: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-19 16:07:33 dovecot_login authenticator failed for (cm-178.232.29.26.get.no) [178.232.29.26]:60088: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 16:07:08 host2 pure-ftpd[69925]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-19 16:07:14 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:63045: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 16:10:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9FnhtUtG7oA+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 16:11:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<AZTruUtGRJs+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 16:15:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<jlb/x0tGQrQ+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 16:16:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<1eG4yEtGoIU+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-19 16:20:01 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:51793: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-19 16:20:15 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:62403: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 16:20:41 host2 sshd[78173]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-19 16:20:36 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:57356: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.71
country_id: 3996063
description:
2025-12-19 16:20:46 dovecot_login authenticator failed for (201.172.89.71-clientes-izzi.mx) [201.172.89.71]:39401: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 16:26:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<z/U97UtGPtw+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 16:26:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<4x9870tG0pY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-19 16:30:56 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:56506: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-19 16:31:34 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:40830: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
country_id: 1269750
description:
2025-12-19 16:34:30 dovecot_login authenticator failed for (abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:38049: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-19 16:34:54 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:37588: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-12-19 16:35:42 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:15704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-19 16:35:56 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:47772: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 16:36:02 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pital) [87.103.126.54]:6412: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.104.43
country_id: 1269750
description:
Dec 19 16:36:38 host2 sshd[88233]: Disconnected from invalid user test 103.113.104.43 port 39274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-12-19 16:36:45 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:57968: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-19 16:36:48 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:47645: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-12-19 16:36:59 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:59596: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-19 16:36:58 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:48396: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 16:38:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<H2m7F0xGYN4+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.84.48.179
country_id: 1643084
description:
2025-12-19 16:39:30 dovecot_plain authenticator failed for (648A5DR0V5VM) [36.84.48.179]:52973: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.104.43
country_id: 1269750
description:
Dec 19 16:41:44 host2 sshd[90928]: Disconnected from invalid user gitlab-runner 103.113.104.43 port 36894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-19 16:42:02 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (preatisic) [73.195.211.98]:52870: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.104.43
country_id: 1269750
description:
Dec 19 16:42:33 host2 sshd[91325]: Disconnected from invalid user ubnt 103.113.104.43 port 51106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.104.43
country_id: 1269750
description:
Dec 19 16:44:06 host2 sshd[92098]: Disconnected from invalid user deploy 103.113.104.43 port 51328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 16:43:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<JxzPKkxGsJI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-19 16:43:42 dovecot_plain authenticator failed for (wurbopoles) [75.97.190.237]:50515: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:46:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eA1iNkxGFNYDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 16:48:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<9YOMO0xGCKI+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:48:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<40WDPExGAM4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-19 16:49:28 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (pition) [73.197.194.98]:41496: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:49:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TnOhQExG+KIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:51:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<OTdtSExGFJgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:52:38 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<r/97S0xGvLEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:53:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TcQ5TkxG1tgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:55:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9jvKVkxG4ugDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:56:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9QzFWExGXOIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 19 16:56:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<nCV+WkxG6LaLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-19 16:59:12 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:42114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 19 16:58:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<E+EMYUxG0qsDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 16:59:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<cl63YkxGGo4+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-19 16:59:42 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:48637: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-19 17:00:26 dovecot_plain authenticator failed for (culize) [65.20.133.4]:40424: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-19 17:01:56 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (lingta) [73.213.237.28]:41184: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.137.61
country_id: 1880251
description:
Dec 19 17:03:31 host2 sshd[105111]: Disconnected from invalid user itsupport 15.235.137.61 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec 19 17:04:20 host2 sshd[105514]: Disconnected from invalid user kms 175.107.32.186 port 54051 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.137.61
country_id: 1880251
description:
Dec 19 17:05:20 host2 sshd[106164]: Disconnected from invalid user tam 15.235.137.61 port 54740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.32.186
country_id: 1168579
description:
Dec 19 17:05:55 host2 sshd[106428]: Disconnected from invalid user tsbot 175.107.32.186 port 24804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.137.61
country_id: 1880251
description:
Dec 19 17:06:01 host2 sshd[106497]: Disconnected from invalid user sk 15.235.137.61 port 38680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-19 17:06:02 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (hynds) [73.129.57.71]:33222: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.107.32.186
country_id: 1168579
description:
Dec 19 17:08:04 host2 sshd[107726]: Disconnected from invalid user squid 175.107.32.186 port 43092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 17:08:11 host2 sshd[107846]: Disconnected from invalid user admin 2.57.121.112 port 36351 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 17:09:22 host2 pure-ftpd[108492]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.85.134.20
country_id: 3686110
description:
Dec 19 17:09:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.85.134.20, lip=66.85.158.91, TLS, session=<0TxsiExGyKK+VYYU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 17:10:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<yPKzjExGBqc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 116.75.218.103
country_id: 1269750
description:
Dec 19 17:10:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=116.75.218.103, lip=66.85.158.91, TLS, session=<iPSgiUxGxtp0S9pn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.61.131.129
country_id: 2510769
description:
2025-12-19 17:10:53 dovecot_login authenticator failed for 129.red-83-61-131.dynamicip.rima-tde.net [83.61.131.129]:44420: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 17:11:33 host2 sshd[109774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-19 17:11:49 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47345: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-19 17:12:09 dovecot_plain authenticator failed for (etionalbes) [199.192.123.12]:33048: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-19 17:11:31 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:34314: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.188.154.6
country_id: 1819730
description:
Dec 19 17:14:17 host2 sshd[111176]: Disconnected from invalid user rtc 218.188.154.6 port 39672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.171.205.18
country_id: 6252001
description:
Dec 19 17:15:08 host2 sshd[111662]: Disconnected from invalid user jon 172.171.205.18 port 51162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.171.205.18
country_id: 6252001
description:
Dec 19 17:15:52 host2 sshd[112049]: Disconnected from invalid user alfa 172.171.205.18 port 52470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.188.154.6
country_id: 1819730
description:
Dec 19 17:16:29 host2 sshd[112399]: Disconnected from invalid user alex 218.188.154.6 port 44838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-19 17:16:33 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42516: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-19 17:16:43 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:52654: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-19 17:19:12 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:49376: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 17:18:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GvVap0xGzNk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 17:19:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<xEtxq0xGpJ4+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 17:19:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<jhnYq0xGAL8+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-19 17:19:43 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52361: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-19 17:20:26 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (cally) [68.40.189.43]:43052: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Dec 19 17:21:15 host2 sshd[115126]: Disconnected from invalid user john 136.119.213.208 port 50180 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 113.193.234.210
country_id: 1269750
description:
Dec 19 17:22:04 host2 sshd[115507]: Disconnected from invalid user ali 113.193.234.210 port 38498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 19 17:22:40 host2 sshd[115820]: Disconnected from invalid user postgres 72.240.125.133 port 37980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.193.234.210
country_id: 1269750
description:
Dec 19 17:22:45 host2 sshd[115846]: Disconnected from invalid user aaa 113.193.234.210 port 22628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.193.234.210
country_id: 1269750
description:
Dec 19 17:24:04 host2 sshd[116576]: Disconnected from invalid user mike 113.193.234.210 port 61410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 19 17:23:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<imKeukxGNJ8+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 17:24:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<NwhcvUxG6NY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.164.49.14
country_id: 1835841
description:
Dec 19 17:24:50 host2 sshd[117047]: Disconnected from invalid user loguser 15.164.49.14 port 43184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Dec 19 17:24:54 host2 sshd[117078]: Disconnected from invalid user loguser 72.240.125.133 port 58602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 17:24:56 host2 sshd[117103]: Disconnected from invalid user user 2.57.121.25 port 45797 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 19 17:25:28 host2 sshd[117539]: Disconnected from invalid user bb 147.50.227.79 port 36648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.60.88.192
country_id: 3175395
description:
Dec 19 17:25:57 host2 sshd[117776]: Disconnected from invalid user q 151.60.88.192 port 34390 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 17:26:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<fHSMxUxG9Ic+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.60.88.192
country_id: 3175395
description:
Dec 19 17:26:50 host2 sshd[118240]: Disconnected from invalid user aaa 151.60.88.192 port 37714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.164.49.14
country_id: 1835841
description:
Dec 19 17:26:53 host2 sshd[118268]: Disconnected from invalid user mc 15.164.49.14 port 35112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-19 17:26:26 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:43278: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.164.49.14
country_id: 1835841
description:
Dec 19 17:27:31 host2 sshd[118621]: Disconnected from invalid user q 15.164.49.14 port 35666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.79
country_id: 1605651
description:
Dec 19 17:27:37 host2 sshd[118684]: Disconnected from invalid user admin 147.50.227.79 port 60974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.202.209
country_id: 6252001
description:
Dec 19 17:28:01 host2 pure-ftpd[118848]: (?@20.118.202.209) [INFO] New connection from 20.118.202.209


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.164.49.14
country_id: 1835841
description:
Dec 19 17:28:08 host2 sshd[119003]: Disconnected from invalid user support 15.164.49.14 port 60694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 17:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<zfLZ00xGRJw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-19 17:30:58 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:64071: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.4
country_id: 1733045
description:
2025-12-19 17:31:15 dovecot_login authenticator failed for ([49.124.132.4]) [49.124.132.4]:43842: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-19 17:33:52 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:53160: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.3.139.163
country_id: 1819730
description:
2025-12-19 17:34:12 dovecot_login authenticator failed for ([210.3.139.172]) [210.3.139.163]:45791: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 19 17:34:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<rydm4kxGBN0+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 17:35:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<McEe5UxGepc+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 17:35:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<x7QW5kxGwqc+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 19 17:39:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, session=<C+pr80xGXMNV2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-19 17:39:47 dovecot_plain authenticator failed for (exproniers) [65.20.233.110]:48247: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.199.60.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 17:50:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<RvSpGU1G3uU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-19 17:55:18 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (sulphype) [73.129.57.71]:54048: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-19 17:57:05 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:57307: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 17:58:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<yAQIOE1GDLo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 17:59:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<accMOU1GXJ4+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-19 17:59:25 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:55526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-19 18:02:16 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:60365: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-19 18:02:26 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:44823: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 18:03:41 host2 sshd[142625]: Disconnected from invalid user alysha 62.60.131.157 port 28619 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 18:05:08 host2 sshd[143756]: Disconnected from invalid user user 2.57.121.25 port 52092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.10.28.230
country_id: 1282988
description:
2025-12-19 18:04:50 dovecot_plain authenticator failed for (R27PCKV70FQ2DWX) [103.10.28.230]:61167: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 18:06:37 host2 sshd[144856]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 18:06:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZmUgVU1G7tg+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 19 18:07:23 host2 sshd[145277]: Disconnected from invalid user jonas 42.200.78.78 port 44304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 19 18:07:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<2k8HWE1GOOc+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 18:07:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<OD9XWE1GhuY+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2025-12-19 18:09:24 dovecot_login authenticator failed for (static-154-209-252-178.pol.net.in) [121.242.112.200]:60940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 19 18:09:33 host2 sshd[146580]: Disconnected from invalid user ubuntu 42.200.78.78 port 57532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-19 18:09:36 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:60326: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 18:10:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<gHzJYk1GmOE+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 19 18:10:56 host2 sshd[147520]: Disconnected from invalid user ubuntu 42.200.78.78 port 56936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.155.74.28
country_id: 357994
description:
2025-12-19 18:10:58 dovecot_plain authenticator failed for (GXA8DC) [196.155.74.28]:19013: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 18:11:46 host2 pure-ftpd[148030]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 19 18:11:55 host2 sshd[148105]: Disconnected from invalid user noreply 179.127.26.32 port 40668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-19 18:14:18 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (woogeouss) [24.23.125.83]:43916: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 19 18:15:00 host2 pure-ftpd[150584]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 19 18:15:02 host2 sshd[150593]: Disconnected from invalid user john 197.211.55.20 port 46996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 18:16:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<rWfKdk1GXts+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 19 18:16:26 host2 sshd[151847]: Disconnected from invalid user devops 179.127.26.32 port 48812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 19 18:15:43 host2 sshd[151290]: Disconnected from invalid user updates 197.211.55.20 port 38674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.186.185
country_id: 3469034
description:
Dec 19 18:15:44 host2 sshd[151304]: Disconnected from invalid user advance 140.238.186.185 port 40726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec 19 18:16:44 host2 sshd[152049]: Disconnected from invalid user ubuntu 159.223.37.230 port 35812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 19 18:17:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<4KL8e01GYNk+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-19 18:19:03 dovecot_login authenticator failed for ([203.145.142.243]) [203.145.142.243]:38516: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-19 18:19:13 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:43386: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-19 18:20:03 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:39162: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-19 18:20:29 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:38799: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.37.230
country_id: 1880251
description:
Dec 19 18:19:42 host2 sshd[154287]: Disconnected from invalid user ansible 159.223.37.230 port 53232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-19 18:21:21 dovecot_plain authenticator failed for (wamengoded) [80.227.102.242]:53491: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.186.185
country_id: 3469034
description:
Dec 19 18:21:50 host2 sshd[156062]: Disconnected from invalid user steam 140.238.186.185 port 52006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 18:22:16 host2 sshd[156384]: Disconnected from invalid user admin 2.57.121.112 port 42325 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-19 18:23:37 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-19 18:23:50 dovecot_login authenticator failed for (31-154-122-202.orange.net.il) [2.55.122.202]:41341: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 18:26:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<DyJdmU1GXI8+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.55.4.75
country_id: 6252001
description:
Dec 19 18:26:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.55.4.75, lip=66.85.158.92, session=<WJeTmU1GHr4UNwRL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.238.186.185
country_id: 3469034
description:
Dec 19 18:28:04 host2 sshd[160632]: Disconnected from invalid user pt 140.238.186.185 port 59660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 18:28:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<sRqtok1Gbqo+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 18:27:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<aucroE1GXLk+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 19 18:31:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tHK7rE1GzCpChJl3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 19 18:33:33 host2 sshd[164468]: Disconnected from invalid user uftp 41.223.40.78 port 45846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Dec 19 18:32:59 host2 sshd[164069]: Disconnected from invalid user roberto 8.213.197.49 port 40236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 19 18:33:06 host2 sshd[164189]: Disconnected from invalid user uftp 201.124.23.196 port 34804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 18:34:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<LiC0tk1G/Ng+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Dec 19 18:34:48 host2 sshd[165445]: Disconnected from invalid user luser 35.237.94.18 port 39112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.78
country_id: 3351879
description:
Dec 19 18:34:56 host2 sshd[165531]: Disconnected from invalid user print 41.223.40.78 port 57222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 19 18:37:10 host2 sshd[167270]: Disconnected from invalid user testftp 201.124.23.196 port 34369 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 19 18:38:21 host2 sshd[168005]: Disconnected from invalid user uftp 41.216.178.119 port 43810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 19 18:38:32 host2 sshd[168113]: Disconnected from invalid user ts3server 201.124.23.196 port 59606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 19 18:39:05 host2 sshd[168433]: Disconnected from invalid user testing 41.216.178.119 port 36972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-19 18:39:25 dovecot_plain authenticator failed for (devous) [24.93.140.162]:43091: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 19 18:39:56 host2 sshd[169001]: Disconnected from invalid user node 201.124.23.196 port 55950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.64
country_id: 1733045
description:
2025-12-19 18:44:17 dovecot_login authenticator failed for ([49.124.153.64]) [49.124.153.64]:35068: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-19 18:44:34 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:46809: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.213.197.49
country_id: 1605651
description:
Dec 19 18:45:45 host2 sshd[173548]: Disconnected from invalid user hostmaster 8.213.197.49 port 49318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 19 18:46:24 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<qW9k4k1GVLwsyhQX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-19 18:49:17 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:48768: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-19 18:49:48 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:44460: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 18:50:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<o4AS8k1GIK8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 18:52:24 host2 sshd[178319]: Disconnected from invalid user 1234 2.57.121.25 port 30912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 19 18:51:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<S00+9U1Gbo3BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.120.45
country_id: 732800
description:
2025-12-19 18:53:11 dovecot_plain authenticator failed for (advithron) [62.73.120.45]:57184: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Dec 19 18:53:55 host2 sshd[179189]: Disconnected from invalid user selenium 45.78.231.192 port 58658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-19 18:54:48 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (dothook) [71.62.34.216]:59606: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 19 18:56:08 host2 sshd[181341]: Disconnected from invalid user pop 107.172.146.104 port 40508 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 18:57:39 host2 sshd[182275]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 19 18:56:51 host2 sshd[181728]: Disconnected from invalid user maks 165.227.3.79 port 43260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Dec 19 18:59:04 host2 sshd[183321]: Disconnected from invalid user maya 57.128.212.198 port 60604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Dec 19 19:00:10 host2 sshd[184368]: Disconnected from invalid user marcel 57.128.212.198 port 48816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 19:00:11 host2 sshd[184376]: Disconnected from invalid user  2.57.121.25 port 29161 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 19:00:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<QP3aE05GhK4+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Dec 19 18:59:57 host2 sshd[184030]: Disconnected from invalid user walter 107.172.146.104 port 52518 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.212.198
country_id: 798544
description:
Dec 19 19:01:15 host2 sshd[185077]: Disconnected from invalid user hasan 57.128.212.198 port 35320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Dec 19 19:00:42 host2 sshd[184738]: Disconnected from invalid user jacob 57.128.212.198 port 57154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Dec 19 19:01:06 host2 sshd[184983]: Disconnected from invalid user administrator 45.78.231.192 port 60078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 19 19:01:46 host2 sshd[185350]: Disconnected from invalid user maks 20.40.73.192 port 57670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Dec 19 19:03:15 host2 sshd[186488]: Disconnected from invalid user oo 45.78.231.192 port 56552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-19 19:03:21 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (saushiness) [73.144.27.228]:45790: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 19 19:03:07 host2 sshd[186380]: Disconnected from invalid user maya 20.40.73.192 port 55888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.40.73.192
country_id: 2077456
description:
Dec 19 19:03:49 host2 sshd[187281]: Disconnected from invalid user reza 20.40.73.192 port 47274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-19 19:04:24 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (perhenia) [24.91.103.202]:45860: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 88.119.167.93
country_id: 597427
description:
Dec 19 19:05:02 host2 sshd[188156]: Received disconnect from 88.119.167.93 port 56702:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.119.167.93
country_id: 597427
description:
Dec 19 19:05:02 host2 sshd[188156]: Disconnected from invalid user jack 88.119.167.93 port 56702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 19 19:05:52 host2 sshd[188852]: Disconnected from invalid user user2 181.116.220.11 port 60518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 19 19:06:37 host2 sshd[189380]: Disconnected from invalid user aracely 62.60.131.157 port 61625 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-12-19 19:07:21 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:50697: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.194
country_id: 1733045
description:
2025-12-19 19:07:38 dovecot_login authenticator failed for ([49.124.148.194]) [49.124.148.194]:55238: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 19 19:09:52 host2 sshd[191379]: Disconnected from invalid user hpc 181.116.220.11 port 54334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 19 19:12:30 host2 sshd[192880]: Disconnected from invalid user anil 181.116.220.11 port 53628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-19 19:12:52 dovecot_login authenticator failed for ([84.215.110.96]) [84.215.110.96]:56110: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-19 19:13:27 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:46416: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-19 19:13:29 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:40490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-19 19:12:47 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (undity) [73.208.81.125]:38568: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 19:12:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<9/+1QE5Gxog+PIMp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 19:14:30 host2 pure-ftpd[194177]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.143
country_id: 6252001
description:
Dec 19 19:14:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.65.194.143, lip=66.85.158.91, session=<He2XRk5GMrsUQcKP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-19 19:14:30 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (decolous) [98.204.134.124]:51326: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 19:15:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<jgPnS05G5qY+PIcg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.95.220.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.95.220.37 - simpleengineerin "GET /frontend/jupiter/index.html HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-19 19:23:48 dovecot_login authenticator failed for (201.173.216.234-clientes-izzi.mx) [201.173.216.234]:47728: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2025-12-19 19:24:21 dovecot_login authenticator failed for ([182.78.242.142]) [182.78.242.142]:58332: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 19 19:26:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<BRBkc05G+Oo+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 19:27:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<TDNMdE5GxKw+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-19 19:28:36 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (arlike) [90.0.156.128]:55620: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-19 19:31:40 dovecot_plain authenticator failed for (cilabity) [5.31.15.108]:48886: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-19 19:31:44 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (fresing) [90.0.156.128]:44230: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-19 19:35:41 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:39560: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 19:35:58 host2 sshd[206912]: Disconnected from invalid user admin 2.57.121.112 port 28845 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-19 19:36:17 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:52932: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-19 19:37:02 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:52190: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.253.13
country_id: 3703430
description:
Dec 19 19:39:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.227.253.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jJnVnk5GBcAt4/0N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 19 19:40:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<TEedo05GnrA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.250.178
country_id: 1269750
description:
2025-12-19 19:43:13 dovecot_login authenticator failed for ([122.180.250.178]) [122.180.250.178]:43990: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-19 19:43:32 dovecot_login authenticator failed for ([36.37.181.181]) [36.37.181.181]:42758: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 19 19:43:38 host2 sshd[211946]: Disconnected from invalid user es 101.47.51.24 port 53048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 19:42:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<e4Srq05G9Io+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 19 19:44:51 host2 sshd[212883]: Disconnected from invalid user demo 36.67.70.198 port 59998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 19:45:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<WBQotU5G+Kw+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-19 19:46:10 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (inimwed) [71.230.228.16]:35270: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.107
country_id: 1814991
description:
Dec 19 19:47:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.107, lip=66.85.158.91, session=<B4vFu05GOZxe585r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Dec 19 19:46:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.91, session=<nNkkuk5GT8he584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 1814991
description:
Dec 19 19:46:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.110, lip=66.85.158.91, session=<hzvDuk5GUb1e585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.108
country_id: 1814991
description:
Dec 19 19:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.108, lip=66.85.158.91, session=<GY+Lu05Gbede585s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 19:47:41 host2 sshd[215021]: Disconnected from invalid user admin 2.57.121.112 port 26213 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 19 19:48:19 host2 sshd[215416]: Disconnected from invalid user michael 182.253.156.184 port 56210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 19 19:48:33 host2 sshd[215666]: Disconnected from invalid user deployer 197.158.254.18 port 39484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.41.212
country_id: 6252001
description:
Dec 19 19:49:14 host2 sshd[216093]: Disconnected from invalid user michael 209.141.41.212 port 59864 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.158.254.18
country_id: 241170
description:
Dec 19 19:49:25 host2 sshd[216244]: Disconnected from invalid user amalia 197.158.254.18 port 53548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-12-19 19:49:00 dovecot_plain authenticator failed for (reezaress) [65.20.129.67]:41974: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.252.170.147
country_id: 3996063
description:
2025-12-19 19:50:22 dovecot_login authenticator failed for ([187.252.170.147]) [187.252.170.147]:36388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-19 19:50:08 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (poingrany) [196.47.172.253]:43553: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-19 19:50:13 dovecot_login authenticator failed for ([84.213.188.130]) [84.213.188.130]:40881: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 19 19:51:07 host2 sshd[217621]: Disconnected from invalid user jarservice 101.47.51.24 port 38228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 19 19:51:24 host2 sshd[217782]: Disconnected from invalid user teste 197.158.254.18 port 53452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Dec 19 19:51:43 host2 sshd[217922]: Disconnected from invalid user user 182.253.156.184 port 57342 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-19 19:52:23 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:39909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-19 19:52:37 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:55880: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 19:52:48 host2 sshd[218610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.41.212
country_id: 6252001
description:
Dec 19 19:52:42 host2 sshd[218465]: Disconnected from invalid user jarservice 209.141.41.212 port 46896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 19 19:52:50 host2 sshd[218621]: Disconnected from invalid user forward 36.67.70.198 port 52782 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.95
country_id: 2635167
description:
Dec 19 19:54:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.95, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dJTe1E5GPsUjy9Jf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 19 19:54:34 host2 sshd[220205]: Disconnected from invalid user tidb 36.67.70.198 port 52986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 19 19:53:44 host2 sshd[219303]: Disconnected from invalid user roots 36.67.70.198 port 52428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 19 19:53:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<NNCs005GqsA+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 19:54:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<sYEm1E5GPKw+PIcg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.132.180.251
country_id: 690791
description:
[2025-12-19 19:54:59 +0530] info [cpaneld] 45.132.180.251 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 19 19:55:00 host2 sshd[220541]: Disconnected from invalid user michael 101.47.51.24 port 55880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.24
country_id: 1880251
description:
Dec 19 19:57:36 host2 sshd[222572]: Disconnected from invalid user tidb 101.47.51.24 port 39398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Dec 19 19:58:43 host2 sshd[223310]: Disconnected from invalid user artem 68.183.88.186 port 54350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.192.131
country_id: 1861060
description:
Dec 19 19:59:14 host2 sshd[223787]: Disconnected from invalid user uno50 43.133.192.131 port 42250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.72.17.43
country_id: 2750405
description:
2025-12-19 19:59:36 dovecot_login authenticator failed for ([77.72.17.43]) [77.72.17.43]:56646: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-19 19:59:51 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:37830: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.88.186
country_id: 1269750
description:
Dec 19 20:00:02 host2 sshd[224247]: Disconnected from invalid user admin 68.183.88.186 port 50524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 19 20:00:03 host2 sshd[224328]: Disconnected from invalid user production 190.129.122.12 port 33527 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.95
country_id: 2635167
description:
Dec 19 20:00:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.95, lip=66.85.158.91, TLS, session=<S7h86k5GfvYjy9Jf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 19 19:59:44 host2 sshd[224076]: Disconnected from invalid user pc 83.142.209.191 port 57776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 19 20:01:20 host2 sshd[225521]: Disconnected from invalid user cloud 83.142.209.191 port 50570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.192.131
country_id: 1861060
description:
Dec 19 20:01:24 host2 sshd[225555]: Disconnected from invalid user deployer 43.133.192.131 port 57034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 19 20:01:34 host2 sshd[225640]: Disconnected from invalid user debian 190.129.122.12 port 33605 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.186.36
country_id: 1269750
description:
Dec 19 20:00:58 host2 sshd[225236]: Disconnected from invalid user qbtuser 143.110.186.36 port 52646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 19 20:01:48 host2 sshd[225831]: Disconnected from invalid user administrator 83.142.209.191 port 39720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-12-19 20:01:58 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:46640: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 20:02:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<sCPF8U5GjoE+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-19 20:02:25 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:45384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-19 20:03:12 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (forper) [76.145.10.140]:44028: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-19 20:03:15 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (proitcric) [68.83.181.181]:45562: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-19 20:03:21 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (inted) [73.176.157.57]:54656: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 19 20:03:39 host2 sshd[227571]: Disconnected from invalid user rolando 190.129.122.12 port 17452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-12-19 20:02:41 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:55410: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.12
country_id: 3923057
description:
Dec 19 20:04:22 host2 sshd[228258]: Disconnected from invalid user server 190.129.122.12 port 17222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-19 20:04:26 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:33744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.192.131
country_id: 1861060
description:
Dec 19 20:04:39 host2 sshd[228425]: Disconnected from invalid user amalia 43.133.192.131 port 42646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.156
country_id: 1880251
description:
Dec 19 20:05:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.156, lip=66.85.158.91, session=<8sbl/U5Gddde586c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.158
country_id: 1880251
description:
Dec 19 20:05:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.158, lip=66.85.158.91, session=<AiiE/k5Gba5e586e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.204
country_id: 1880251
description:
Dec 19 20:06:05 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.204, lip=66.85.158.91, session=<MVZZ/05GcdZe587M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 20:06:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<RG2G/05GbrI+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.243.213.125
country_id: 290557
description:
Dec 19 20:07:11 host2 sshd[230135]: Disconnected from invalid user ocean 151.243.213.125 port 35890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.194.235.86
country_id: 290557
description:
Dec 19 20:07:29 host2 sshd[230272]: Disconnected from invalid user amalia 5.194.235.86 port 46532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.135.74
country_id: 1269750
description:
2025-12-19 20:06:43 dovecot_login authenticator failed for (solitude.engreensolutions.com.) [103.59.135.74]:49999: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 151.243.213.125
country_id: 290557
description:
Dec 19 20:07:11 host2 sshd[230135]: Received disconnect from 151.243.213.125 port 35890:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 19 20:09:12 host2 sshd[231297]: Disconnected from invalid user indico 151.243.213.125 port 39332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.194.235.86
country_id: 290557
description:
Dec 19 20:08:58 host2 sshd[231120]: Disconnected from invalid user admin 5.194.235.86 port 52936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.194.235.86
country_id: 290557
description:
Dec 19 20:09:41 host2 sshd[231692]: Disconnected from invalid user george 5.194.235.86 port 57736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 19 20:09:44 host2 sshd[231720]: Disconnected from invalid user soporte 151.243.213.125 port 52782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.57.84
country_id: 3469034
description:
Dec 19 20:11:18 host2 sshd[232961]: Disconnected from invalid user webapp 187.72.57.84 port 34021 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 20:11:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<QBPSEE9GEJ4+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 19 20:12:40 host2 sshd[233724]: Disconnected from invalid user speedtest 154.70.102.114 port 37156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-19 20:13:43 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:35894: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-19 20:13:59 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:35666: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 19 20:14:04 host2 sshd[235073]: Disconnected from invalid user frappe 154.70.102.114 port 60614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 19 20:14:20 host2 sshd[235268]: Disconnected from invalid user ts 154.124.97.102 port 39435 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-19 20:14:49 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:56460: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-19 20:15:13 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33836: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.72.57.84
country_id: 3469034
description:
Dec 19 20:15:17 host2 sshd[236317]: Disconnected from invalid user sudesh 187.72.57.84 port 37469 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 20:14:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Y1UiHU9GWIM+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 20:17:12 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (sarkheepus) [87.103.126.54]:8965: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 20:17:33 host2 pure-ftpd[237603]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 20:17:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<YDxjKU9G5qs+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 20:20:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<BVYyMU9G/K8+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 20:20:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<gc2oMk9G2Lg+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-19 20:21:55 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (codes) [73.88.196.91]:55950: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 20:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<nHacO09GCt4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 20:22:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8FaBO09GWuo+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.233.70.101
country_id: 3865483
description:
Dec 19 20:26:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<httpssmtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.233.70.101, lip=66.85.158.91, TLS, session=<74bKRk9GG8Cq6UZl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.85.20
country_id: 3865483
description:
Dec 19 20:27:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 39 secs): user=<httpssmtp.zoho.com587hr>, method=PLAIN, rip=190.181.85.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DZAOSE9GQZS+tVUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.20.148.129
country_id: 99237
description:
Dec 19 20:27:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=65.20.148.129, lip=66.85.158.91, TLS, session=<GzyPSk9Gr7VBFJSB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-12-19 20:29:49 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:35482: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-19 20:29:59 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:58000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 20:33:51 host2 sshd[248349]: Disconnected from invalid user  2.57.121.25 port 37242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 19 20:37:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<lMvFbU9Gcr8+PIdc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 20:39:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<KMOqd09Gwos+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 20:41:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (caraticon) [87.103.126.54]:41614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-19 20:41:54 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (profflux) [76.106.163.189]:42754: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 20:46:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<x1wEkE9GosI+PIde>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 20:48:14 host2 sshd[258517]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-19 20:48:45 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:38526: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 19 20:51:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, session=<EXcbo09G+MBV2ZUJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.50
country_id: 6252001
description:
Dec 19 20:52:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=44.220.185.50, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8+zCo09GNugs3Lky>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 20:53:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<O/5Fp09GlO0+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-19 20:55:14 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (oveheton) [196.47.172.253]:49061: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.15
country_id: 798549
description:
Dec 19 20:57:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.15, lip=66.85.158.92, session=<k3/Xt09GDOjUSZQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 20:59:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<4rwXvk9G8OU+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.5
country_id: 2750405
description:
Dec 19 21:00:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=31.14.32.5, lip=66.85.158.92, session=<Z2ifwU9GgqUfDiAF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 21:00:47 host2 sshd[267836]: Disconnected from invalid user admin 2.57.121.112 port 38363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-19 21:01:12 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:59448: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-19 21:01:43 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:43813: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 21:03:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<MOxFy09G6uU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-19 21:02:27 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:52212: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-19 21:02:40 dovecot_login authenticator failed for ([113.203.205.37]) [113.203.205.37]:55628: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-19 21:04:33 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:51176: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-19 21:05:21 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:53905: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 21:05:25 host2 sshd[271298]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-12-19 21:07:21 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:54814: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 21:08:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4ZGt3E9GSpU+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 19 21:10:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<WQ2+5U9G8Ig+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 21:11:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<FPj/509G9Jw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 19 21:13:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<ERG67k9Gws0+PIMp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 21:12:27 host2 sshd[276070]: Disconnected from invalid user  2.57.121.25 port 23181 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 21:12:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<EAaF7U9G7M8+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-19 21:13:37 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (accal) [73.13.220.220]:42174: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.144.90
country_id: 6252001
description:
Dec 19 21:17:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.144.90, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<T/M4/k9GqN0UQZBa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 21:20:34 host2 pure-ftpd[281713]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 19 21:23:51 host2 sshd[283583]: Disconnected from invalid user roo 51.178.43.161 port 53480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 21:24:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eWqVFlBG6Ls+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-19 21:25:44 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:53984: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-19 21:25:54 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:42010: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 19 21:26:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<kw9XHlBGnKU+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 19 21:25:25 host2 sshd[284718]: Disconnected from invalid user ws 20.193.141.133 port 36610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 19 21:25:41 host2 sshd[284839]: Disconnected from invalid user usuario2 51.178.43.161 port 58126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 19 21:26:41 host2 sshd[285389]: Disconnected from invalid user ankit 20.193.141.133 port 16199 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 19 21:27:11 host2 sshd[285662]: Disconnected from invalid user admin 51.178.43.161 port 37988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 19 21:29:05 host2 sshd[286704]: Disconnected from invalid user bitrix 141.95.162.162 port 60440 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.132
country_id: 6252001
description:
Dec 19 21:29:28 host2 pure-ftpd[286897]: (?@198.235.24.132) [INFO] New connection from 198.235.24.132


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 19 21:29:40 host2 sshd[286973]: Received disconnect from 51.178.43.161 port 42058:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 19 21:29:40 host2 sshd[286973]: Disconnected from invalid user ankit 51.178.43.161 port 42058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 19 21:30:41 host2 sshd[287793]: Disconnected from invalid user roo 20.193.141.133 port 18805 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 19 21:31:36 host2 sshd[288316]: Disconnected from invalid user admin 141.95.162.162 port 41854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-19 21:32:53 dovecot_plain authenticator failed for (doptran) [24.93.140.162]:44885: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.210
country_id: 1643084
description:
Dec 19 21:33:50 host2 sshd[289438]: Disconnected from invalid user foundry 103.191.14.210 port 57020 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.194.251.17
country_id: 1605651
description:
Dec 19 21:37:19 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.194.251.17, lip=66.85.158.92, TLS, session=<MYOZRVBGki92wvsR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.251.17
country_id: 1605651
description:
Dec 19 21:37:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.194.251.17, lip=66.85.158.92, session=<ZCmFRVBGPi52wvsR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.35.19
country_id: 1814991
description:
2025-12-19 21:37:27 dovecot_login authenticator failed for (hNPTAWFIw) [183.167.35.19]:45497: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 19 21:38:33 host2 sshd[292576]: Disconnected from invalid user qa 62.219.172.50 port 54532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.35.19
country_id: 1814991
description:
2025-12-19 21:38:39 dovecot_login authenticator failed for (ksBASfH) [183.167.35.19]:43082: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.204.64.103
country_id: 3489940
description:
2025-12-19 21:38:41 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [207.204.64.103]:65211: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 183.167.35.19
country_id: 1814991
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[183.167.35.19] [Authentication Database]=[mail] [Username]=[info@fhb.health.gov.lk] (5/5 failures) (blocked until [Fri Dec 19 16:24:04 2025 UTC/Fri Dec 19 21:54:04 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 19 21:41:17 host2 sshd[294363]: Disconnected from invalid user orange 62.219.172.50 port 54692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 21:40:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<dv5JUlBGTKM+PIdl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Dec 19 21:41:57 host2 sshd[294762]: Disconnected from invalid user mine 62.219.172.50 port 52158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec 19 21:42:33 host2 sshd[295081]: Disconnected from invalid user karen 62.219.172.50 port 55952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2025-12-19 21:46:05 dovecot_login authenticator failed for ([49.124.146.41]) [49.124.146.41]:34110: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-19 21:46:25 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:49215: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-19 21:47:37 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:42120: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-19 21:47:58 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:33006: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 19 21:47:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<682aa1BG6tc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-19 21:48:26 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:2750: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 19 21:48:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<m3enblBGTElAPsW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.85
country_id: 1733045
description:
2025-12-19 21:51:45 dovecot_login authenticator failed for ([49.125.201.85]) [49.125.201.85]:48812: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-19 21:52:06 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:36160: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 19 21:52:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<PPOZelBGcq0+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-19 21:52:31 dovecot_login authenticator failed for ([182.95.85.181]) [182.95.123.46]:56676: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.41
country_id: 6252001
description:
Dec 19 21:53:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<eVUlflBGuresynYp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-19 21:56:07 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:33345: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-19 21:56:21 dovecot_login authenticator failed for (aes-static-177.143.22.125.airtel.in) [128.185.239.182]:35724: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 21:56:22 host2 sshd[313624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 19 21:56:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<q3rTiVBG2uc+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 19 21:58:10 host2 sshd[318932]: Disconnected from invalid user  2.57.121.25 port 48265 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-19 22:00:30 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:56124: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-19 22:00:54 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:11739: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.129
country_id: 6252001
description:
Dec 19 22:01:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.129, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7xVsnFBGYpMtT8+B>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 19 22:02:16 host2 sshd[321305]: Disconnected from invalid user boss 178.17.58.173 port 50750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 19 22:03:18 host2 sshd[322160]: Disconnected from invalid user user1 37.59.110.4 port 43660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 19 22:03:48 host2 sshd[322383]: Disconnected from invalid user dell 103.193.176.131 port 46160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 19 22:03:25 host2 sshd[322233]: Disconnected from invalid user ubuntu 43.163.9.217 port 38152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-19 22:03:33 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (ortress) [73.88.196.91]:44204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 19 22:03:40 host2 sshd[322328]: Disconnected from invalid user artin 172.191.157.64 port 35998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 19 22:04:38 host2 sshd[322780]: Disconnected from invalid user vpn 68.233.116.124 port 15964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 19 22:05:03 host2 sshd[323142]: Disconnected from invalid user amir 178.17.58.173 port 46604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 19 22:05:19 host2 sshd[323335]: Disconnected from invalid user ftptest 103.193.176.131 port 46230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 19 22:04:26 host2 sshd[322703]: Disconnected from invalid user james 37.59.110.4 port 32860 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 19 22:05:59 host2 sshd[323739]: Disconnected from invalid user ubuntu 68.233.116.124 port 43624 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.161
country_id: 6252001
description:
Dec 19 22:06:14 host2 pure-ftpd[324046]: (?@205.210.31.161) [INFO] New connection from 205.210.31.161


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 19 22:05:28 host2 sshd[323430]: Disconnected from invalid user kiosk 37.59.110.4 port 38690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Dec 19 22:05:32 host2 sshd[323461]: Disconnected from invalid user dell 172.191.157.64 port 58504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 19 22:06:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6lbDrVBGDrc+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 19 22:07:00 host2 sshd[324461]: Disconnected from invalid user demo 37.59.110.4 port 55014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 19 22:07:22 host2 sshd[324801]: Disconnected from invalid user peter 43.163.9.217 port 33144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 19 22:07:27 host2 sshd[324867]: Disconnected from invalid user user1 103.193.176.131 port 46342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 19 22:08:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<68PLtFBGCHJChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 19 22:08:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<SY4+tlBGdNE+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 19 22:10:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<mx2EulBGcoE+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 19 22:10:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<HIbou1BGxFrUZija>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 22:11:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<h5Q+wVBGvtQ+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-19 22:12:09 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:56307: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-19 22:13:06 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:59248: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.162
country_id: 2542007
description:
2025-12-19 22:13:18 dovecot_login authenticator failed for ([105.73.190.162]) [105.73.190.162]:50753: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.97
country_id: 6252001
description:
Dec 19 22:13:51 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.97, lip=66.85.158.91, session=<rihIyFBG0+Nb5qhh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.98
country_id: 6252001
description:
Dec 19 22:13:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.98, lip=66.85.158.91, session=<OiB3yFBGUdtb5qhi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.99
country_id: 6252001
description:
Dec 19 22:13:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.99, lip=66.85.158.91, session=<J+HnxlBGR9db5qhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.227
country_id: 6252001
description:
Dec 19 22:13:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.227, lip=66.85.158.91, session=<16qBx1BGD9hb5qjj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-19 22:13:48 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:59028: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 19 22:15:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<SW0Wz1BGgMNChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-19 22:16:10 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (osing) [68.40.189.43]:52584: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 22:18:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<esTi11BGQss+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-19 22:18:50 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:47569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-19 22:18:27 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:59332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.158.36
country_id: 294640
description:
2025-12-19 22:21:31 dovecot_login authenticator failed for ([82.102.158.36]) [82.102.158.36]:40285: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-19 22:21:51 dovecot_login authenticator failed for (cm-178.232.237.107.get.no) [178.232.237.107]:36795: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-19 22:22:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unter) [87.103.126.54]:19184: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 22:23:11 host2 pure-ftpd[337771]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 19 22:23:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<MZFo61BGKK8+PIdf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.199.14.27
country_id: 2750405
description:
[2025-12-19 22:27:35 +0530] info [webmaild] 154.199.14.27 - awanish@maximsholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


