# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 16:46:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<beKibhNDkNCP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 16:49:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<DPQXeBNDmITRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 16:49:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<8WJfeRNDzKYv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.186
country_id: 2328926
description:
2025-11-08 16:51:34 dovecot_login authenticator failed for (lezzarotech.com) [197.211.52.186]:47657: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 16:52:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<RXSGgxNDUJYBFNmn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 16:54:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wxE6ihNDuIY+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-11-08 16:54:25 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:34996: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 16:54:52 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:60887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 16:58:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<J+/1mRNDZNyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:00:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<BX2voBNDjSC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 17:01:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<3UmmohNDoq1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 17:01:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<OViFpBNDMKxCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 17:03:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<72aHqhND9uwz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 17:03:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<05qkqhNDHo+l0xnK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.255.208.83
country_id: 1814991
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 116.255.208.83 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 17:04:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zgoKrhND+K0vWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov  8 17:06:04 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<BVcNtBND9f7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.39
country_id: 1880251
description:
Nov  8 17:06:57 host2 sshd[736491]: Disconnected from invalid user runner 45.78.222.39 port 38484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.116
country_id: 2464461
description:
2025-11-08 17:07:02 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.116]:36832: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-08 17:06:28 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:53980: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:06:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<vt7fthND7KmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 17:07:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<gGWPuBNDBIGl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:07:14 host2 sshd[736909]: Disconnected from invalid user jahan 50.84.211.204 port 60774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 17:08:45 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<w/2IvRNDYs9K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 17:08:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<m+uavRNDooMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 17:09:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Pv4WvxNDGt4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Fbm7xhNDDqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<AHayxhNDQjJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:11:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<vPNVxxNDzJVK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.175.30.243
country_id: 6252001
description:
2025-11-08 17:12:33 dovecot_plain authenticator failed for c-73-175-30-243.hsd1.pa.comcast.net ([89.116.164.85]) [73.175.30.243]:53920: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.22.125.38
country_id: 6252001
description:
2025-11-08 17:12:44 dovecot_plain authenticator failed for 174-22-125-38.dvnp.qwest.net ([89.116.164.85]) [174.22.125.38]:40675: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.202.4.186
country_id: 3625428
description:
2025-11-08 17:12:55 dovecot_plain authenticator failed for ([89.116.164.85]) [190.202.4.186]:13829: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 17:13:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<JWS9zBND7r4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:13:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<WIPYzhNDzNmP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 17:13:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<aTpzzxND+pMrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 17:13:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<l6ozzhNDSt1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:14:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1MMr0hND8K6PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:14:32 host2 sshd[745499]: Disconnected from invalid user david 50.84.211.204 port 37362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:15:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<3D6u1BND4r5m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:15:46 host2 sshd[746949]: Disconnected from invalid user prueba 50.84.211.204 port 38158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-08 17:16:28 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:43744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:16:41 host2 sshd[748000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-08 17:16:50 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:59401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 17:17:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Fyev2xNDoNcr4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 17:18:49 host2 sshd[750270]: Disconnected from invalid user user 2.57.121.25 port 37743 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:21:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<jz106hNDfMdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-08 17:23:03 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:54960: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-08 17:23:19 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:59524: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:24:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Ww7S9BNDfMcv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:25:57 host2 sshd[758658]: Disconnected from invalid user test 162.240.156.34 port 54556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:26:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<LXAl/BND+Ndm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 17:26:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4/sg/BNDJOeYIMkL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:27:20 host2 sshd[760473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:28:18 host2 sshd[761624]: Disconnected from invalid user ll 162.240.156.34 port 39536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-08 17:28:45 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:56210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 17:29:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lWJkBhRDJoxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 17:29:39 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Pn5GCBRDJsTRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.106.224.231
country_id: 783754
description:
2025-11-08 17:30:41 dovecot_plain authenticator failed for ([89.116.164.85]) [79.106.224.231]:33614: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:30:49 host2 sshd[764477]: Disconnected from invalid user hesam 162.240.156.34 port 40428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.55.232.113
country_id: 3469034
description:
2025-11-08 17:30:55 dovecot_plain authenticator failed for ([89.116.164.85]) [189.55.232.113]:42284: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:33:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<moicFBRDjrJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:34:15 host2 sshd[768111]: Disconnected from invalid user bit 162.240.156.34 port 41712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-08 17:36:22 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:46812: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:36:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<GZAAIRRD5oFD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:36:39 host2 sshd[771107]: Disconnected from invalid user tesoreria 162.240.156.34 port 42596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:37:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nZc/IxRDwI0v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 17:37:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<+miiIxRDQNJm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 17:40:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<tw1fLxRD/oUBFNmn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-08 17:42:25 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:59748: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-08 17:42:47 dovecot_login authenticator failed for erpump.tcil.in [1.7.83.133]:41232: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-08 17:43:08 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:34042: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:43:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<yv1+OBRDDI9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 17:45:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<KbhtQhRDoNpnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:45:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5W18QhRDfJaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:46:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=</vfoQhRDOsGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 17:46:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Y2wYRhRDPp+i8JQo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  8 17:47:17 host2 pure-ftpd[783057]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 17:47:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<V32lSRRDotUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 17:48:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<TBr3ShRDNJrRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 17:50:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<PkUIUhRDRpxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:52:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<gSJHWRRDquBK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-11-08 17:52:38 dovecot_login authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:59652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-08 17:52:54 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:48153: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 17:54:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<USenYhRDYqgvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:58:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<WOifbRRDtBe2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.248
country_id: 3865483
description:
Nov  8 17:59:51 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.96.195.248, lip=66.85.158.91, TLS, session=<qQhCcxRDiay6YMP4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:00:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2J2LdRRDLi6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.30.227
country_id: 933860
description:
Nov  8 18:00:15 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=83.143.30.227, lip=66.85.158.91, TLS, session=<7BiYdBRDjp5Tjx7j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:00:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</u3ldRRD4qQz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:00:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<bpC7dxRDlFcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 18:03:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<AXa1fxRDnJ9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 18:05:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<3FXqiRRD0JpK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 18:06:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<ZiyXihRDEtlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 18:07:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<bpQNjhRD3IMzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 18:07:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sOcVkBRDiqil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:07:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OWpQkBRD+JOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:07:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lMRpkBRDMqWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 18:09:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xURclRRDot4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 18:10:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zxtsmRRDegRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:10:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EIsFmxRDmJOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 18:10:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<rm3bmxRDWsSl0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:14:11 host2 sshd[815648]: Disconnected from invalid user perry 62.60.131.157 port 41358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 18:13:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<B9qfphRDjtArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 18:15:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Tyn6qhRD4O1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:15:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SCAsrBRDsqdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 18:15:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<5ZE7rBRDPJIr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-08 18:15:37 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (caraele) [71.41.202.12]:35243: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:16:29 host2 sshd[818167]: Disconnected from invalid user admin 203.154.162.65 port 50234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8VDrsRRD/OVK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:17:43 host2 sshd[819617]: Disconnected from invalid user ian 203.154.162.65 port 49278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-08 18:17:53 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:53862: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-08 18:18:08 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:46444: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-08 18:18:25 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:48234: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 18:18:34 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:53207: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:20:13 host2 sshd[822427]: Disconnected from invalid user devops 203.154.162.65 port 47374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 18:20:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<E+I6vRRDGIiOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:23:53 host2 sshd[826279]: Disconnected from invalid user ts3 203.154.162.65 port 44526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:24:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ygLKyhRD2MlnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 18:25:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<oP040RRD4p3RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:26:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c99+0xRDANNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:27:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Srz01xRDDjmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 18:28:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Zo172RRDFspnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 18:28:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=</dMA2xRDVOcBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 18:34:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<3fqh7hRDMuRm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov  8 18:35:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<VikU9RRDBpKnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:35:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vVVn9RRDbJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:36:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<HKe39xRDPphD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:43:04 host2 sshd[848310]: Disconnected from invalid user perry 62.60.131.157 port 40105 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:43:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<+hFCDxVDXtlD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 18:43:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZPv6DxVDGIdnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-08 18:43:48 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:53192: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-08 18:44:23 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:51858: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 18:44:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jxiSExVDuuyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 18:46:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<fKt5HBVDXpcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:46:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<VB3MHBVDPoOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 18:47:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<ZCZZHRVDTJvRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 18:51:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5k5DLRVDojEv7AMK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 18:52:55 host2 sshd[860511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 18:54:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fJTwNxVDiq9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 18:55:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<GwmwOxVDSPq2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 18:56:16 host2 sshd[864700]: Disconnected from invalid user kevin 101.47.161.161 port 39740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:57:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<YJCKQRVDqJFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<3K8NQBVDp/ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<J7AXQBVDfckz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 18:59:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<RN+6ShVDNNIvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 18:59:57 host2 sshd[868564]: Disconnected from invalid user user 2.57.121.25 port 41572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-08 19:01:14 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:50210: 535 Incorrect authentication data (set_id=mail@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:02:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hprMUhVDRleYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:02:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Yj8IVBVDFNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:02:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<v2+uVBVDIrlK0NqG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:03:39 host2 sshd[873632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 19:04:26 host2 sshd[874572]: Disconnected from invalid user tidb 101.47.161.161 port 60836 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 19:04:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<LnA/XBVDzMFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 19:04:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<WIWgXBVDDIQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:05:27 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nFPmXhVDBpaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 19:06:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mqWMYhVDTqal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 19:06:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5DoYZBVDdgUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 19:07:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LkVPZhVDxSJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:09:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<dbnkaxVDCrOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 19:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<2j0BbBVDmNYv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 19:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Ctu1bBVDysdCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:10:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Zb5FcBVDKIqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 19:10:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<IShfcBVDZrcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 19:13:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<ARMXfRVDhLor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 19:14:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2NWzfxVDBN8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 19:16:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<OGd/hRVDANgBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 19:16:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=</V6UhxVDgrSl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:16:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<a1lThhVDLthm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 19:19:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<bdQWkRVD5I9n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 19:22:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<tGfymhVDjpZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 19:21:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Rj61mRVDTt7RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 19:22:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<Cc4NnBVD8LOOtOyP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:24:48 host2 pure-ftpd[897276]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 19:26:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<urBXqhVDzKRnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:27:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C44PrhVDBuhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:28:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<14CRsBVDHpFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:29:59 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4G+ZthVDYGKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 19:30:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<ZD1YuBVD4odm1PbI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:30:54 host2 pure-ftpd[903980]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:35:15 host2 sshd[908080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:35:08 host2 sshd[908411]: Disconnected from invalid user doris 27.254.235.2 port 35162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:36:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<qHgszxVDGuRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 19:37:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Hask0BVD4pai8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:40:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kkjc2xVDqo1noNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:41:05 host2 sshd[915119]: Disconnected from invalid user sina 27.254.235.2 port 54054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 19:42:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<RziT4RVDiOtnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:43:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lp/S5hVDlIND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:43:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ziIh6BVDpJ2P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 19:43:53 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:53270: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 19:44:02 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:64772: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-08 19:44:20 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:59415: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 19:44:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<bjwd6xVDIOLRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 19:46:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<rcjo7xVDgK4v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:48:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<o2I7+RVD9pyxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:51:00 host2 sshd[926026]: Disconnected from invalid user newuser 27.254.235.2 port 47358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 19:52:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<EdMTBxZD6ZIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 19:53:06 host2 sshd[928390]: Disconnected from invalid user alexys 62.60.131.157 port 35074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 19:53:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<fueMCRZDM4Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 19:54:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<8bjPDRZDbVu2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-11-08 19:56:04 dovecot_plain authenticator failed for (diese) [65.20.163.103]:47010: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:57:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3ebhFxZDmqyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 19:58:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ytS+HRZDMqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:00:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lDJVIhZDHOePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:59:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<EMKmHxZDtNVK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 19:59:26 host2 sshd[935113]: Disconnected from invalid user user 2.57.121.25 port 41715 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:00:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LbzuJBZDZsOi2JXJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:01:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gVzbJhZDouqi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:02:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<oWSfKRZDSoQzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  8 20:02:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DG+2KxZDqOdChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:03:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<XDnRLBZDauVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:04:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<bqFuMBZDtsoBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 20:04:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<XxGNMRZDap0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:04:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8JyrMhZD9ICYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 20:05:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61799: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 20:05:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oZbtNBZDqh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 20:06:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cxUDOhZDDI+l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:06:44 host2 sshd[943124]: Disconnected from invalid user julius 2.113.74.42 port 51290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 20:08:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<QECPPhZD6IkrZDwA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:08:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS, session=<hnFRPxZDjvSi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:09:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<wA62QhZDoraP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 20:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<26mMQhZDxtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 20:09:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Z15IRRZDoMlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:10:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<NmVHSBZDOMuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 20:11:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<h6ENSxZDWItCYSpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:11:37 host2 sshd[948429]: Disconnected from invalid user orca 168.167.228.74 port 35318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  8 20:12:29 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<Czq1ThZDLtkjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:13:19 host2 sshd[950183]: Disconnected from invalid user max 168.167.228.74 port 35319 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-08 20:14:28 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:33703: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:14:59 host2 sshd[951805]: Disconnected from invalid user init 122.166.49.42 port 50190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-08 20:15:01 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:58303: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 20:15:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Uo/CWBZDqqUr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 20:15:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<zhUPWxZDlNcrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:16:22 host2 sshd[953449]: Disconnected from invalid user webmaster 2.113.74.42 port 51254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:17:07 host2 sshd[954191]: Disconnected from invalid user netbox 45.78.216.103 port 47618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:17:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<NiSiXxZD/Ndm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:21:06 host2 sshd[958758]: Disconnected from invalid user rsyncuser 168.167.228.74 port 35324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:21:09 host2 sshd[958775]: Disconnected from invalid user test_user 2.113.74.42 port 46892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:21:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<q0yZbhZDCKAv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:22:23 host2 sshd[960082]: Disconnected from invalid user debian 45.78.216.103 port 40300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 20:22:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<sVC9cxZDir6l0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:23:49 host2 sshd[961498]: Disconnected from invalid user mohammed 103.59.94.124 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:24:48 host2 sshd[962389]: Disconnected from invalid user api_user 122.166.49.42 port 35578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 20:24:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<skB5eRZDVqBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 20:25:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<7yaifBZDZruOtOyP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:25:52 host2 sshd[964154]: Disconnected from invalid user sagar 168.167.228.74 port 35327 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 20:27:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<5gGGghZD7plm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:28:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<n522hhZDONRm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:28:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<Rv+QhxZDpJ5K4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:29:44 host2 sshd[968227]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.202
country_id: 6252001
description:
Nov  8 20:31:13 host2 pure-ftpd[970020]: (?@195.184.76.202) [INFO] New connection from 195.184.76.202


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.204
country_id: 6252001
description:
Nov  8 20:31:12 host2 pure-ftpd[970004]: (?@195.184.76.204) [INFO] New connection from 195.184.76.204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:31:23 host2 sshd[970379]: Disconnected from invalid user raul 103.59.94.124 port 34324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:32:47 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<hYI3lxZDquhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:32:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hw6plhZDJoyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:34:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<vTvzmxZDhGQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 20:34:12 host2 sshd[973768]: Disconnected from invalid user baby 62.60.131.157 port 34869 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Phh6phZDfqpD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:37:45 host2 sshd[977830]: Disconnected from invalid user daniil 103.59.94.124 port 52288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:39:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3DWRsBZDotmP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:39:18 host2 sshd[979422]: Disconnected from invalid user user 103.59.94.124 port 45434 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:40:32 host2 sshd[980773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 20:40:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<mk9XshZDurNnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 20:42:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<6isruhZD9LnRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:42:52 host2 sshd[983005]: Disconnected from invalid user webmaster 45.78.216.103 port 55488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:43:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lslSvhZD3rFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:44:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<pRyjwhZDpLJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:45:28 host2 sshd[986233]: Disconnected from invalid user test_user 45.78.216.103 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 20:45:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Myp5xRZDUsov+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 20:47:49 host2 sshd[988647]: Disconnected from invalid user wang 102.176.81.29 port 49266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 20:48:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<HC+lzxZDox4vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 20:49:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dKlr1BZDsaUz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:51:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<Jfml2BZDbrsBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:51:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uPUE2RZD9JqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:50:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<y1kJ1hZDaJexiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:51:26 host2 sshd[992460]: Disconnected from invalid user njs 81.30.162.18 port 46869 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:52:41 host2 sshd[993778]: Disconnected from invalid user harry 81.30.162.18 port 60550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 20:53:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CIsB4hZDgrK2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:53:59 host2 sshd[995141]: Disconnected from invalid user sebastian 81.30.162.18 port 45995 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:54:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hiGQ4xZDjs6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 20:55:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<gBKE6RZDML5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:59:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<64ns9hZDhoQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 21:02:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TMcIABdDIzdniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.137
country_id: 2635167
description:
Nov  8 21:02:25 host2 pure-ftpd[1004344]: (?@87.236.176.137) [INFO] New connection from 87.236.176.137


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 21:02:31 host2 sshd[1004485]: Disconnected from invalid user baby 62.60.131.157 port 46912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:02:40 host2 sshd[1004605]: Disconnected from invalid user dev 102.176.81.29 port 42436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 21:03:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2qaPBBdDeKlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 21:04:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fzyOBxdDALGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:04:13 host2 sshd[1006626]: Disconnected from invalid user njs 102.176.81.29 port 46502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:05:06 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:58264: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 21:05:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<XUtZDRdDwKgrZDwA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Nov  8 21:06:05 host2 pure-ftpd[1009107]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-08 21:05:23 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:54532: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:05:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xqS0CxdDnJqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:07:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hkN0EhdDYKqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 21:09:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uST+GBdDGJYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 21:08:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<4liiGBdDoso+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 21:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<NOHgGRdDJtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:09:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<W1joGRdDFKFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:11:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<69XxIhdD2r0+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 21:13:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Yv+TKRdDjs1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 21:14:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<D+XCKhdDmo9CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 21:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2BSeNRdD+r0rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 21:16:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<s2aQMhdDQo4r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:16:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<TqgZMxdDONM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:17:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<krvKOBdDFMBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 21:23:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<EGwLTBdDAKxm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:03 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ucFCUhdD4NFBMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:22 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oB9cUxdDPuxBMQGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 21:26:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<EWT/VxdD1LBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 21:27:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<324GWxdDzuCi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 21:27:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<iIT8WxdDUq2OtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:29:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<fY+DYBdD/uxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 21:29:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<RNmgYRdDTKul0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-08 21:33:13 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:33550: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-08 21:33:35 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54518: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:34:31 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:57014: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:34:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uGa+dBdDQudK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:35:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Pb2bdhdDprWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:36:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jAS9ehdD2uGP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  8 21:36:31 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<U8xCexdDj/7CpRCl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:36:52 host2 sshd[1043041]: Disconnected from invalid user user1 152.32.129.136 port 54972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 21:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<RaIOfRdDXsVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 21:38:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<SD9JgRdDVqwBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 21:37:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<7fsUfxdDCIRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 21:38:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ia/rghdDlIJnVK2y>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:39:46 host2 sshd[1046068]: Disconnected from invalid user flex 152.32.129.136 port 15286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  8 21:40:16 host2 dovecot[1045703]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<fvysiBdD/LO4aYtF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 21:40:41 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<a9IPihdDxqvRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 21:44:17 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<CrLslhdDooFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 21:44:57 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<x+o3mRdDpncvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:44:58 host2 sshd[1071464]: Disconnected from invalid user ospite 152.32.129.136 port 43466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 21:45:30 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nrNDmxdD9J2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 21:45:51 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<46R+nBdDjLcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 21:46:56 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<DjNcoBdDEMsz0msW>


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Nov  8 21:48:53 host2 dovecot[1078594]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 21:49:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<0R97qBdDVIhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 21:50:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<URx3qxdDkA0v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 21:52:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<zkcjsxdDYLuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 21:52:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<TQa+sxdDdtNK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 21:53:58 host2 sshd[1084518]: Disconnected from invalid user ubuntu 45.249.247.86 port 53068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-08 21:54:26 dovecot_plain authenticator failed for (unifistum) [65.20.204.193]:44595: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 21:54:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<h2g0uxdD5Lq2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-08 21:57:00 dovecot_plain authenticator failed for (undly) [65.20.204.193]:49806: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 21:57:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<0LgSxRdDuoQzTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 21:58:06 host2 sshd[1089364]: Disconnected from invalid user depot 45.249.247.86 port 42218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-08 21:58:15 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:38540: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-11-08 21:57:56 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:48269: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 21:59:07 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Yx3zyxdDdglniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 22:01:28 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JJdb1BdD1ISl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:01:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<XEC91RdDgLGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 22:03:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nOiX2hdDctAv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.33
country_id: 6252001
description:
Nov  8 22:03:48 host2 pure-ftpd[1109066]: (?@198.235.24.33) [INFO] New connection from 198.235.24.33


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 22:03:57 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<kkA33RdDPtkrZDwA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 22:04:05 host2 sshd[1109406]: Disconnected from invalid user afzal 45.249.247.86 port 58770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 22:06:40 host2 sshd[1112389]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 22:07:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9MXj6hdD4K1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 22:09:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<woac8BdD1Ikv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 22:10:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<DpcH8xdDBNSYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.101
country_id: 6252001
description:
Nov  8 22:10:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.101, lip=66.85.158.92, TLS: Connection closed, session=<gpqs9BdD4JrHLZtl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  8 22:10:45 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<UdW09RdDTp6UccFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-08 22:12:24 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:41952: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.151.205
country_id: 1880251
description:
2025-11-08 22:12:35 dovecot_login authenticator failed for bb116-14-151-205.singnet.com.sg [116.14.151.205]:47789: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 22:11:54 host2 sshd[1118196]: Disconnected from invalid user kacey 62.60.131.157 port 15076 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 22:14:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<XWdHAhhDdJaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 22:13:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<w43GABhDtqEvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-08 22:15:20 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (suconeys) [68.60.77.128]:38170: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 22:15:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uOASCBhDfJBK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 22:17:21 host2 sshd[1124563]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 22:16:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<J+ePCxhD5LNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 22:17:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QXKuDBhDZOwr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 22:17:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wabXDhhDBOBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 22:18:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<YxpwEBhDFtMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 22:19:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<AGUtFBhDDp1m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:20:06 host2 sshd[1127410]: Disconnected from invalid user mahdi 177.229.197.38 port 36436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 22:20:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<f7EtGBhDAL5m1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:21:34 host2 sshd[1128783]: Disconnected from invalid user rain 177.229.197.38 port 56540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov  8 22:24:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<koPfJRhDdg5APpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.191
country_id: 6252001
description:
Nov  8 22:23:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<owPJJBhD7fBAPpy/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 22:25:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<g/5wKxhDfp4BFNmn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:27:04 host2 sshd[1134717]: Disconnected from invalid user justine 177.229.197.38 port 57646 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 100.26.106.240
country_id: 6252001
description:
Nov  8 22:27:54 host2 pure-ftpd[1135437]: (?@100.26.106.240) [INFO] New connection from 100.26.106.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:27:58 host2 sshd[1135618]: Disconnected from invalid user webadmin 107.173.127.215 port 42194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 22:28:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<s8jDNBhDUMFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 22:30:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<LqFePBhD/rNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 22:31:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<5OUGPxhDEpOOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:31:49 host2 sshd[1139657]: Disconnected from invalid user ec2-user 107.173.127.215 port 57050 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 22:32:41 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<CjEFRBhDFq0+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Nov  8 22:32:42 host2 sshd[1140822]: Disconnected from invalid user webadmin 118.26.36.241 port 40816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:33:17 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<8QckRhhDDKWP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov  8 22:34:31 host2 sshd[1142815]: Disconnected from invalid user ac 185.158.23.150 port 8885 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:34:25 host2 sshd[1142732]: Disconnected from invalid user mary 107.173.127.215 port 56786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 22:35:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<OXwKTxhD4Kel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 22:36:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<Rt4fURhDkOVnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 22:36:41 host2 sshd[1145411]: Disconnected from invalid user administrator 197.134.250.149 port 53476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov  8 22:37:38 host2 sshd[1146467]: Disconnected from invalid user test_user 185.158.23.150 port 6501 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.161
country_id: 6252001
description:
Nov  8 22:37:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rgwyVhhD+U9APpyh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  8 22:38:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zTFHVxhDyBFAPpyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 22:38:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UZZqWBhDPt+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 22:38:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<ry5/WBhD8s9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 22:38:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<jtteWhhDjKbRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 22:40:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<SySaXxhDLNOPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.254.83
country_id: 357994
description:
Nov  8 22:41:47 host2 sshd[1150985]: Disconnected from invalid user erp 197.134.254.83 port 36717 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  8 22:41:49 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WWzMZBhDzJ5ChJl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 22:41:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QXs5YxhDOqBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 22:41:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<QUMhZBhDNp9K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 22:41:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<u41BZBhDYb8vWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Nov  8 22:43:10 host2 sshd[1152633]: Disconnected from invalid user james 155.4.244.107 port 56908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 22:43:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<riU6ahhD0pGPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:43:57 host2 sshd[1153473]: Disconnected from invalid user simon 103.153.110.189 port 50360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 22:44:27 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<i3YZbhhDo+gz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 22:44:58 host2 sshd[1154836]: Disconnected from invalid user hyperspace 196.221.165.62 port 64120 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 22:45:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<kUCXcBhDjMND2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:45:26 host2 sshd[1155793]: Disconnected from invalid user mas 103.153.110.189 port 56512 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.163.139
country_id: 2658434
description:
Nov  8 22:46:10 host2 pure-ftpd[1156692]: (?@35.216.163.139) [INFO] New connection from 35.216.163.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.204.150
country_id: 357994
description:
Nov  8 22:46:32 host2 sshd[1157202]: Disconnected from invalid user builder 196.221.204.150 port 19954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 22:46:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<W4didhhDgo0v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-08 22:46:03 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:35604: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.163.139
country_id: 2658434
description:
Nov  8 22:46:05 host2 pure-ftpd[1156629]: (?@35.216.163.139) [INFO] New connection from 35.216.163.139


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:47:01 host2 sshd[1157731]: Disconnected from invalid user ubuntu 103.153.110.189 port 58088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-08 22:47:04 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:65152: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 22:49:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<zdf7fhhD1MBK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 22:49:51 host2 sshd[1161036]: Disconnected from invalid user oracle 197.134.250.149 port 52460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.178
country_id: 6252001
description:
Nov  8 22:50:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.178, lip=66.85.158.91, session=<piZggxhDpaBBMQGy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:50:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<feyRgxhDuokDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 22:50:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS: Connection closed, session=<yKwahBhDwH1BMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:51:09 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<1sgqhhhD3KsDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 22:51:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<1TsyhxhDoNk+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:52:09 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<gxC6iRhDgIsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:52:58 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<R4+rjBhDKLQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-11-08 22:53:23 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:50192: 535 Incorrect authentication data (set_id=careers@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 22:53:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vRmrjhhDkNZnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.54
country_id: 1733045
description:
2025-11-08 22:53:54 dovecot_login authenticator failed for ([49.124.149.54]) [49.124.149.54]:45706: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:53:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GegEkBhDnoYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 22:54:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<//OHkxhDvqKxiOOT>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:55:46 host2 dovecot[1078614]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<8iWwlhhDLLwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 22:55:59 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Dz5blxhDjHu2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 22:57:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<T2tgnBhDGyVniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:57:35 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<diAonRhDhIADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:57:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<kPpMnhhD7K+P9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:58:15 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<71OSnxhDet4DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.212.214.10
country_id: 357994
description:
Nov  8 22:59:47 host2 sshd[1172460]: Disconnected from invalid user sammy 213.212.214.10 port 18984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 22:59:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+t0FpBhD4uWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 23:01:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<4J4IqxhDmIIrZDwA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.204.150
country_id: 357994
description:
Nov  8 23:01:32 host2 sshd[1174846]: Disconnected from invalid user srv 196.221.204.150 port 35243 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  8 23:03:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<fJP8sRhDDJlChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:05:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+004uRhDiNyTuYWr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:06:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<D1KAvBhDBveTuYWr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.38.76
country_id: 357994
description:
Nov  8 23:09:46 host2 sshd[1185226]: Disconnected from invalid user tino 196.221.38.76 port 51010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 23:09:52 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=</tD6yBhDzMsv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-08 23:11:24 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:59656: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:11:27 host2 sshd[1187469]: Disconnected from invalid user james 196.221.165.62 port 62162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  8 23:11:29 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<zJbkzhhDAreUccFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:12:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS, session=<Jczr0BhDAOCTuYWr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 23:12:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5XnA0xhDiptnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 23:13:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<xpah1RhDHCeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 23:13:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<CV7n1RhDqJABFNmn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 23:14:55 host2 sshd[1191142]: Disconnected from invalid user ts3server 197.134.250.149 port 34269 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-11-08 23:16:08 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (slawete) [73.171.230.200]:37065: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:16:32 host2 sshd[1192942]: Disconnected from invalid user max 196.221.165.62 port 50522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.187
country_id: 6252001
description:
Nov  8 23:16:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.187, lip=66.85.158.92, session=<YMUQ4hhDCwlAPpy7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov  8 23:17:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS: Connection closed, session=<wRjg4hhDFm1APpy2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 23:17:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<ZAir5BhDxOyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 23:18:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<a75Q5xhD7M9m1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 23:18:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<a7226BhDsNcr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 23:19:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<ixEE6hhD9OwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.161
country_id: 798544
description:
Nov  8 23:19:41 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.240.44.161, lip=66.85.158.91, TLS, session=<9Uk36xhDSM1b8Cyh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 23:20:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ymQe7xhD4qArmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.38.76
country_id: 357994
description:
Nov  8 23:19:54 host2 sshd[1196669]: Disconnected from invalid user ac 196.221.38.76 port 17509 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 23:20:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<K15M7RhDkptm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.109.56.74
country_id: 3469034
description:
Nov  8 23:20:01 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=179.109.56.74, lip=66.85.158.91, TLS, session=<QjVc7BhDkMuzbThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 23:20:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Xn9a7hhD/oRCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 23:21:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<1DCs8hhDMHkv7AMK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:21:35 host2 sshd[1198527]: Disconnected from invalid user localhost 196.221.165.62 port 33765 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 23:22:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<3tyl9BhDKs2i8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 23:23:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<A8Op+BhDILhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 23:23:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<rcCG+RhD7rxK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.153.132.112
country_id: 1269750
description:
Nov  8 23:22:54 host2 sshd[1199821]: Disconnected from invalid user proxyuser 20.153.132.112 port 34782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Nov  8 23:26:22 host2 sshd[1203685]: Disconnected from invalid user sepehr 190.153.249.99 port 41749 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 23:29:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Au6lDhlDYN+P9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:29:22 host2 sshd[1206798]: Disconnected from invalid user soksuser 43.133.185.172 port 44150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:30:43 host2 sshd[1208529]: Disconnected from invalid user mark 43.133.185.172 port 33136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 23:30:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<qbiCERlDvNFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 23:31:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9fsWFRlDgLZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-08 23:31:22 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:49713: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-08 23:31:06 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:43714: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:33:27 host2 sshd[1211499]: Disconnected from invalid user root1 43.133.185.172 port 37916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  8 23:34:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<39qrHxlDIQjCpRCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 23:34:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<KtzCIBlD2OhnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 23:35:39 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Hj8uJRlDzNaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 23:35:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<kQ1gJRlD4kEv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.189.114.125
country_id: 719819
description:
Nov  8 23:35:50 host2 pure-ftpd[1214326]: (?@185.189.114.125) [INFO] New connection from 185.189.114.125


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.89.117
country_id: 660013
description:
Nov  8 23:35:53 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.126.89.117, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jEgfJhlDtp+8fll1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.9
country_id: 3895114
description:
Nov  8 23:35:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.11.9, lip=66.85.158.91, session=<sMgeJhlDepOSRgsJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.142
country_id: 2802361
description:
Nov  8 23:35:52 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=181.214.218.142, lip=66.85.158.91, session=<iN8bJhlDfpO11tqO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Nov  8 23:37:09 host2 sshd[1215815]: Disconnected from invalid user mapadmin 107.173.10.71 port 59716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov  8 23:37:13 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fFTwKhlDbv8t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:37:19 host2 sshd[1216068]: Disconnected from invalid user rta 43.133.185.172 port 35054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 23:37:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<nrwYLBlDLKrRJvZG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Nov  8 23:38:50 host2 sshd[1217513]: Disconnected from invalid user odoo 190.153.249.99 port 48440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 23:38:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Srb5LxlDXpqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 23:39:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<R6KOMhlDKw0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 23:39:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<++ukMhlDtqZD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 23:42:26 host2 sshd[1221921]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 23:42:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<dDJJPBlDrjKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 23:43:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<81n6PxlDZZYz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 23:44:10 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ntqnQxlD/sM+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Nov  8 23:43:55 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.91, session=<jonnQhlDLChBMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 23:44:52 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<qCAgRhlDvOFK0NqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Nov  8 23:45:25 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.92, session=<kOI9SBlDnoes7ORv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 23:45:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<e2WGSBlDitpD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 23:45:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<WqyySRlD6thnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 23:47:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<DxHiThlD8uSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-08 23:48:17 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:37096: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 23:47:57 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Ee4nURlDiOwv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.194
country_id: 1733045
description:
2025-11-08 23:49:00 dovecot_login authenticator failed for ([49.124.159.194]) [49.124.159.194]:34608: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 23:49:27 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<5heIVhlDNrVK4fqm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.63.209
country_id: 2802361
description:
Nov  8 23:49:30 host2 pure-ftpd[1230852]: (?@34.140.63.209) [INFO] New connection from 34.140.63.209


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 23:53:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<MpOjZBlDPuGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 23:55:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zr2qahlDNUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 23:55:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<DJwEbRlD87i2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 23:56:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<G7m9bhlDfrGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 23:56:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<kfjPcBlDXpil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 23:56:14 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<hH/NbhlDRtYrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 23:58:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<8o1YdhlD8rs+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 23:58:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<CAAfdRlDssxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 00:05:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<2b60jhlD0qc+PIOJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.118
country_id: 3017382
description:
Nov  9 00:07:15 host2 pure-ftpd[1252401]: (?@91.196.152.118) [INFO] New connection from 91.196.152.118


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.24
country_id: 3017382
description:
Nov  9 00:07:16 host2 pure-ftpd[1252479]: (?@91.196.152.24) [INFO] New connection from 91.196.152.24


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 00:10:43 host2 sshd[1256399]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 00:10:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<IShKohlDZMAv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 00:14:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<4Cp1rxlDCNkr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-09 00:14:22 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:46476: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-09 00:14:32 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:40603: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 00:15:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<oZ1isxlDArRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 00:16:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<fw44txlD6uFm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 00:17:08 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<VqiGuRlD9JyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 00:17:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<kivhuxlDvFGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 00:19:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<w1v0wRlDyI1m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 00:21:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<rXclyRlDPolCYSpH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 00:21:16 host2 sshd[1269204]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 00:23:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<lBd2zxlDTICP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 00:23:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<30KH0RlDrqormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.101
country_id: 798544
description:
Nov  9 00:24:26 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=212.59.224.101, lip=66.85.158.91, TLS, session=<9LXI0hlDTKXUO+Bl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.185
country_id: 798544
description:
Nov  9 00:24:45 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.247.185, lip=66.85.158.91, TLS, session=<E5fg0xlDSa5tffe5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-09 00:24:50 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:40862: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-11-09 00:25:05 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:39670: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 00:25:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DP492BlDeLlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 00:27:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<wgeu3hlDPuxnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 00:30:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mOG96RlD/M9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 00:31:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<KI1n7BlDWsSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 00:31:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<02P+7RlD+K5K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 00:31:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<koIT7hlDMOJn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.39
country_id: 2921044
description:
Nov  9 00:34:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=139.59.136.39, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<I0ws9hlDZ3WLO4gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-11-09 00:33:56 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:45099: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.39
country_id: 2921044
description:
Nov  9 00:34:10 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=139.59.136.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<SNKR9hlDpROLO4gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-11-09 00:34:18 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:34600: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 00:34:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Rb8/9xlDpr6PbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.30.169
country_id: 2921044
description:
Nov  9 00:34:39 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.30.169, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ic1I+BlDeEyd5h6p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-09 00:34:55 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:40636: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 00:36:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Mcld/hlDHpND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 00:36:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<VqOk/xlDJpzRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 00:37:44 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56839: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 00:38:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<axYtBBpDFFUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 00:38:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<sp2MBRpDgoRK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 00:42:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<mB2rEhpDSqoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 00:43:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<28cCFxpDKotD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.126
country_id: 6252001
description:
Nov  9 00:44:05 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<degMGhpDzMgUQGl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 00:46:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qRyZIxpDfl2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 00:47:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<rKSBJhpDPteP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 00:47:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<a1LxJhpDjNAv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 00:49:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<EnwLLBpDCJcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 00:50:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<XpN4MBpDKOwrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-11-09 00:50:52 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:50084: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 00:50:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JIxVMhpDethnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-09 00:51:35 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:58064: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.56.179
country_id: 6252001
description:
Nov  9 00:51:17 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.221.56.179, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d/zOMxpDDpMU3Tiz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 00:52:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Bwz/NhpDJhhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 00:53:08 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rR1ROhpDEIal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 00:54:14 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<mLsyPhpDrmG2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 00:54:59 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<fhntQBpDLpOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 00:57:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<gHRdSxpD0sRK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  9 01:01:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<H/ytVxpD4LWl0xnK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov  9 01:02:17 host2 pure-ftpd[1321498]: (?@198.235.24.41) [INFO] New connection from 198.235.24.41


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 01:02:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<wMk0WxpDKp4v7AMK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.79.53
country_id: 6252001
description:
Nov  9 01:03:37 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.56.79.53, lip=66.85.158.91, session=<kXruXxpDkJQtOE81>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 01:03:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ReEVYBpDjs1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 01:12:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=</iv0fRpDqp4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 01:12:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Tu9MfxpDKtkr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 01:15:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<6JQIixpDuoVm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 01:15:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<niuwixpDmumxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:16:10 host2 sshd[1338212]: Disconnected from invalid user ts1 45.78.217.142 port 37228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-11-09 01:16:41 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:52589: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-09 01:16:57 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:50041: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Nov  9 01:17:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.157, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<VhG+khpDsci594md>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:17:20 host2 sshd[1339881]: Disconnected from invalid user api_user 103.213.238.91 port 35082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  9 01:17:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<ETBukRpDsLWi8JQo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:17:42 host2 sshd[1340392]: Disconnected from invalid user ts1 172.245.177.148 port 50156 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.72
country_id: 2635167
description:
Nov  9 01:17:49 host2 dovecot[1078614]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.72, lip=66.85.158.91, TLS, session=<mr6vkhpDgdpX7LBI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 01:18:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<8ZVulBpD4paP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.172
country_id: 2635167
description:
Nov  9 01:18:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.172, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Fyq5lBpD+c6594ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.157
country_id: 2635167
description:
Nov  9 01:18:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<b5a0lhpDCZxX7LCd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Nov  9 01:19:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.165, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<zwywmBpDBYe594ml>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.237.3
country_id: 1819730
description:
Nov  9 01:19:42 host2 sshd[1342794]: Disconnected from invalid user artur 47.83.237.3 port 60868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.179
country_id: 2635167
description:
Nov  9 01:20:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.179, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Nr2rmhpD4YJX7LCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 01:20:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<teSQnBpD4tRm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.150
country_id: 2635167
description:
Nov  9 01:20:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.150, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZQmlnBpD45m594mW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.171
country_id: 2635167
description:
Nov  9 01:21:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.171, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ro+doBpD0Za594mr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.176
country_id: 2635167
description:
Nov  9 01:21:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.176, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Dk+inhpDzc1X7LCw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.170
country_id: 2635167
description:
Nov  9 01:22:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.170, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<SxCXohpDv9S594mq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 01:22:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OOsTpBpDhr1nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Nov  9 01:22:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<X7mSpBpD97e594ml>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:23:51 host2 sshd[1347713]: Disconnected from invalid user celeryuser 103.213.238.91 port 38632 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 01:23:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qThLqBpDan2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 01:24:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<3PKAqhpDWsJnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:24:34 host2 sshd[1348667]: Disconnected from invalid user akshay 172.245.177.148 port 48734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Nov  9 01:25:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.92, TLS handshaking: Connection closed, session=<icqhrBpDa9fDuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Nov  9 01:25:19 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tVSErRpDbMPN0h9Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov  9 01:25:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9fCerRpDBgnCpRCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Nov  9 01:25:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PZIOrhpDQaLDuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.73
country_id: 6252001
description:
Nov  9 01:25:31 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.73, lip=66.85.158.92, TLS: Connection closed, session=<xHY9rhpDm9rDuExJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:25:42 host2 sshd[1350152]: Disconnected from invalid user svn 172.245.177.148 port 49278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.154
country_id: 6252001
description:
Nov  9 01:25:15 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.154, lip=66.85.158.92, TLS: Connection closed, session=<zZ1CrRpDueDDuEya>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:26:52 host2 sshd[1351478]: Disconnected from invalid user user5 172.245.177.148 port 49830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.237.3
country_id: 1819730
description:
Nov  9 01:27:00 host2 sshd[1351637]: Disconnected from invalid user svn 47.83.237.3 port 50290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 01:27:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<T84fthpD2tlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 01:28:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<6zHeuBpD4MkrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:28:59 host2 sshd[1353904]: Disconnected from invalid user admin 103.213.238.91 port 50684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 01:29:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<YACyuhpDWI+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 01:29:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xcLNvBpDXLFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-09 01:30:47 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:52321: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Nov  9 01:30:49 host2 sshd[1356053]: Disconnected from invalid user gogs 103.4.145.50 port 42332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-09 01:30:40 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:54744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:30:42 host2 sshd[1355930]: Disconnected from invalid user posiflex 103.213.238.91 port 54686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Nov  9 01:31:10 host2 dovecot[1078614]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.51, lip=66.85.158.91, session=<lzZuwhpDBrqsaAsz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:31:21 host2 sshd[1356652]: Disconnected from invalid user ww 181.49.8.57 port 33190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 01:31:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ZnNwxBpDLNxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 01:32:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<gCgwxhpD4t+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 01:32:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<e0gWxxpDWLovT1jH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:33:29 host2 sshd[1359253]: Disconnected from invalid user zammad 181.49.8.57 port 58810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 01:34:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<5dsozhpDeoRn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.94
country_id: 6252001
description:
Nov  9 01:35:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.94, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<huoC0RpDCNjN0h9e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:36:33 host2 sshd[1362498]: Disconnected from invalid user splunk 181.49.8.57 port 40780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:36:38 host2 sshd[1362509]: Disconnected from invalid user celeryuser 45.78.217.142 port 37032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Nov  9 01:37:00 host2 sshd[1362863]: Disconnected from invalid user hadoop 103.4.145.50 port 52512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 01:37:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<rOj12BpDbKVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 01:38:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<FTPy2hpDFInRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 01:38:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<odII3RpDfZ0vWbHj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.123
country_id: 2635167
description:
Nov  9 01:39:06 host2 dovecot[1078614]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.123, lip=66.85.158.91, TLS, session=<gs7G3hpDY95X7LB7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  9 01:39:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<zmzO4BpDJIiOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 01:39:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<4F6a4RpD4MRD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:40:26 host2 sshd[1366556]: Disconnected from invalid user andreas 190.156.238.162 port 57298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 01:40:41 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<9StX5BpDCIhK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-09 01:41:39 dovecot_login authenticator failed for (74-95-13-185-sfba.hfc.comcastbusiness.net) [74.95.13.185]:54058: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-09 01:41:50 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:50349: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 01:42:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</25p6xpDP74z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:43:47 host2 sshd[1370013]: Disconnected from invalid user teamspeak 190.156.238.162 port 44480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 01:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<tEpk8xpD7LqP9IUv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:45:26 host2 sshd[1372538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 01:47:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<I8kG+xpDZplD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov  9 01:47:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<BcVG/RpDVP4t4/6Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 01:47:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<ugI3/RpDzKwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 01:48:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<aBLxARtDCDNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 01:51:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<P5oTCxtDGqul6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.81
country_id: 6252001
description:
Nov  9 01:51:54 host2 pure-ftpd[1379570]: (?@198.235.24.81) [INFO] New connection from 198.235.24.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-09 01:53:00 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:53814: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 01:52:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ZAv4DhtDAImYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-09 01:52:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:44448: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 01:53:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<a++xERtD+VK2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 01:53:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<FBJUEhtDrJIv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 01:53:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5Xp5EhtDdtCxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:55:55 host2 sshd[1384367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 01:58:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Ar/BJBtD6p1noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:59:50 host2 sshd[1388564]: Disconnected from invalid user mana 45.78.217.142 port 57762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.134
country_id: 3469034
description:
Nov  9 02:01:13 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=187.120.73.134, lip=66.85.158.91, TLS, session=<2n+2LBtDaNy7eEmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.92
country_id: 798544
description:
Nov  9 02:01:30 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.228.33.92, lip=66.85.158.91, TLS, session=<B1nvLRtDqIZb5CFc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:02:27 host2 sshd[1391993]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:05:00 host2 sshd[1395011]: Disconnected from invalid user svn 45.78.217.142 port 39694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 02:05:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<3zjvPRtDLMA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:07:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<w6kzRRtDyLhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:09:59 host2 sshd[1400515]: Disconnected from invalid user posiflex 45.78.217.142 port 50716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 02:11:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<CvSWUhtDSJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 02:11:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QaS7UhtDMt8r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  9 02:12:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<bb0IVRtD8qKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:14:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<J72LXRtDMNGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 02:15:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<fc36YRtDMrMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 02:15:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<FNnYYRtD0pdm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:17:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<dq72ZhtDAIaP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 02:19:50 host2 sshd[1412316]: Disconnected from invalid user soporte 190.156.238.162 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:20:28 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<OXuhchtD3EQv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:22:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<RA1xeBtDNNhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 02:22:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<M6lIeRtD5M5nVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-09 02:23:09 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:52815: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-09 02:23:26 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:50666: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:24:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7/KmgRtDctM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:27:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<KOM6ihtDsKeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:27:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pfIEjRtDGOiPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:29:01 host2 sshd[1423919]: Disconnected from invalid user sbi 196.196.253.2 port 54686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:31:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<OFqKmBtD3OaPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:30:45 host2 sshd[1426003]: Disconnected from invalid user choi 4.213.177.240 port 57278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:31:32 host2 sshd[1427236]: Disconnected from invalid user tmp 196.196.253.2 port 58416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 02:31:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kTI8mxtDaIZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:33:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<DYnvoBtD+qNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:33:43 host2 sshd[1430171]: Disconnected from invalid user deployer 4.213.177.240 port 58332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 02:34:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wE0RpBtD6OdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 02:34:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<RsFaphtDVJQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:35:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<o+ylphtDZBAv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 02:35:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<EeeMqBtDTpdCYSpH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.33
country_id: 1733045
description:
Nov  9 02:35:38 host2 sshd[1432620]: Disconnected from invalid user gu 202.157.177.33 port 37126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 02:37:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<CJJnrhtDls1K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 02:37:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<0hg1sRtD9JRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 02:40:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Qu60uBtD9OUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 02:40:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<j5g1uRtDgMjRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-09 02:40:18 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:47934: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-09 02:40:30 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:58338: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:40:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7DqjuhtDHsM+PIOJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:42:05 host2 sshd[1439758]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:41:33 host2 sshd[1439149]: Disconnected from invalid user mark 4.213.177.240 port 37616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:42:45 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<KhhSwhtDCqeP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 02:44:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yZOWyBtDLL8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:44:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<5dqiyRtDQqBD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 02:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<iNDzyRtDluwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 02:45:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oFnbyxtDak1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.243
country_id: 3175395
description:
Nov  9 02:46:45 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.243, lip=66.85.158.91, TLS, session=<X3avzxtD8rfZGrPz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.167
country_id: 3175395
description:
Nov  9 02:47:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.43.16.167, lip=66.85.158.91, TLS, session=<vTHT0BtDstm5KxCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-09 02:48:48 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:51457: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-09 02:48:56 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:51655: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-09 02:48:11 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (housion) [73.88.196.91]:51610: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 02:50:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<aFlv3htDKJGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:51:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<J7iF4RtDlLdK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:52:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<98Bn4xtDCoxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 02:52:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CaCT5BtDuTC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:52:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<G9lW5RtDbJmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:56:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<evD08RtDerOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 02:58:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<up25+RtD8Kov+yzS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:00:23 host2 sshd[1461946]: Disconnected from invalid user eun 201.76.120.30 port 37324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:02:05 host2 sshd[1463679]: Disconnected from invalid user redhat 201.76.120.30 port 41600 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  9 03:02:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<727qBxxDgoNChJmC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:03:49 host2 sshd[1466682]: Disconnected from invalid user wangxin 201.76.120.30 port 45876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.71.21
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.71.21, lip=66.85.158.92, session=<xm7IDxxDgWmhI0cV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.214.41
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.214.41, lip=66.85.158.92, session=<F9zODxxD1LekWtYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:07:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4CBCGhxDmKVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  9 03:08:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<jdXTHBxDaJqi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 03:11:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<MCpMKhxD7Okr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-09 03:13:45 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:53574: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:13:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<D61SMRxDfNyxiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-09 03:13:54 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:60878: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:13:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<rZa0MRxDCuaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 03:16:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<6iemOhxD2qlm1PbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-11-09 03:16:31 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:35794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-09 03:16:51 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:36872: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov  9 03:17:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, session=<37qbPhxDSOjG6xhS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-09 03:17:59 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:46403: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 03:18:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<UvIGQRxDKpFK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-09 03:18:18 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:11253: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:19:55 host2 sshd[1486400]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 03:20:07 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<SZ7yRxxDuqMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:20:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<cLwBSRxDiMtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 03:20:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZbqlSRxDNqpnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-09 03:20:58 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:50654: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-09 03:22:21 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:44743: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:23:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<pblSVBxDVuxm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.93
country_id: 1880251
description:
Nov  9 03:23:49 host2 sshd[1491328]: Disconnected from invalid user rocketmq 45.78.205.93 port 34320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Nov  9 03:24:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, TLS: Connection closed, session=<mC1TVxxD/75bxJiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.166
country_id: 3017382
description:
Nov  9 03:24:39 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.166, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xOdIWBxD89JbxJim>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Nov  9 03:24:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iHahVhxD+aZbxJiR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:26:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<R0AHXxxDfoKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:27:44 host2 sshd[1496251]: Disconnected from invalid user user 101.47.48.65 port 57306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:29:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<IUJcahxDzriPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:30:24 host2 sshd[1499618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 03:33:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<upcHeRxDnNOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:34:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<BO0qfBxDcqZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 03:37:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<vOh2hhxDQLxK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 03:38:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Fmb2hxxDdqVn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:39:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<H5XRixxD2KuP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 03:40:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<GdjujxxDoLlA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 03:41:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6pJ7lBxDRqdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 03:41:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mk//lBxDZjQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 03:42:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Q7hGmRxDdrDRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:42:13 host2 sshd[1513251]: Disconnected from invalid user erpnext 43.173.120.212 port 37110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<64sPmBxD5oUrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<V5sImBxD2sArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 03:42:49 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<n+0imRxDNyFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:44:00 host2 sshd[1515171]: Disconnected from invalid user bill 43.173.120.212 port 43570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 03:44:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<At9vnxxDbL1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 03:46:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<2pSKpBxD6KU+PIOL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.199.63.109
country_id: 2802361
description:
Nov  9 03:46:10 host2 pure-ftpd[1519066]: (?@104.199.63.109) [INFO] New connection from 104.199.63.109


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:46:27 host2 sshd[1519448]: Disconnected from invalid user oem 43.173.120.212 port 46374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 03:46:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<BmM3phxDvcAz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:47:38 host2 sshd[1521783]: Disconnected from invalid user ca 43.173.120.212 port 47776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  9 03:48:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<u0UKrBxDTMSOtOyP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 03:49:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=</FFurxxD2OQvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:48:11 host2 sshd[1522451]: Disconnected from invalid user vision 101.36.124.127 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:50:07 host2 sshd[1524712]: Disconnected from invalid user manager 101.36.108.134 port 55000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 03:50:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+8SxsxxD0oql6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:50:17 host2 sshd[1524998]: Disconnected from invalid user toby 101.47.48.65 port 58296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:50:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<zI/5sxxD0I5D2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  9 03:50:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1A1ntRxDMqNChJly>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:51:22 host2 sshd[1526466]: Disconnected from invalid user www 101.36.108.134 port 60238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 03:51:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<1/WZuBxDoXa2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:52:15 host2 sshd[1527620]: Disconnected from invalid user zookeeper 151.49.129.67 port 34890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:52:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<XVYwvBxD4taxiOOT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:52:37 host2 sshd[1528242]: Disconnected from invalid user ca 101.36.108.134 port 41654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:53:35 host2 sshd[1529366]: Disconnected from invalid user cyl 151.49.129.67 port 55816 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 03:54:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jlOrxBxD/i+hI8Fx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.39
country_id: 2921044
description:
Nov  9 03:54:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.29.39, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<roCQwhxDn1Gd5h0n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:55:24 host2 sshd[1532185]: Disconnected from invalid user ec2-user 101.36.124.127 port 52544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 03:56:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Rf9QyBxDOMQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:56:35 host2 sshd[1533444]: Disconnected from invalid user moshe 101.36.124.127 port 43708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 03:56:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<43iYyRxDkuA+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:57:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Jiz9zRxDpKJD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 04:00:43 host2 sshd[1538374]: Disconnected from invalid user pos 151.49.129.67 port 57354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:00:22 host2 sshd[1538071]: Disconnected from invalid user office 101.36.108.134 port 56114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:01:44 host2 sshd[1539358]: Disconnected from invalid user bill 101.36.108.134 port 54868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.43
country_id: 798544
description:
Nov  9 04:01:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=178.216.29.43, lip=66.85.158.91, TLS, session=<7YJG3BxDocyy2B0r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:01:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<dwCz2xxDSI9K4fqm>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.54.213.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.54.213.197: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-09 04:02:45 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (daling) [73.145.107.251]:46286: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.179.44.27
country_id: 1831722
description:
2025-11-09 04:02:53 H=(87.117.231.66) [167.179.44.27]:59077 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <orange@imobust.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.103.58
country_id: 798544
description:
Nov  9 04:02:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.150.103.58, lip=66.85.158.91, TLS, session=<XRpV3RxDnLjClmc6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 04:03:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<SJHh4xxDRpsv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:04:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<JVVC5xxDPOCYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:08:37 host2 sshd[1547697]: Disconnected from invalid user vivek 185.217.131.127 port 38134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.167.33
country_id: 6252001
description:
Nov  9 04:11:35 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.167.33, lip=66.85.158.91, session=<ziomAB1D2ooUU6ch>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:11:19 host2 sshd[1551511]: Disconnected from invalid user public 185.217.131.127 port 58356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 04:11:21 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<zLYy/xxDkpMv7AMK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:12:37 host2 sshd[1553688]: Disconnected from invalid user ice 185.217.131.127 port 57644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 04:12:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QKsLBB1DTIor4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 04:12:55 host2 sshd[1554075]: Disconnected from invalid user rtorrent 101.47.48.65 port 38496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:14:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<atMpCh1Dfr6xiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-09 04:15:37 dovecot_plain authenticator failed for (unbeety) [38.148.95.217]:39219: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:17:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Pi0GFh1DbJRnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:18:40 host2 sshd[1561206]: Disconnected from invalid user mahmoud 45.78.216.136 port 60924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:18:55 host2 sshd[1561514]: Disconnected from invalid user dolphinscheduler 185.217.131.127 port 34582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 04:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<RUBuFx1D8Ltm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 04:19:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<lspgGx1DOLVnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:19:53 host2 sshd[1562666]: Disconnected from invalid user marketing 103.210.22.17 port 58544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:20:45 host2 sshd[1563901]: Disconnected from invalid user couchdb 45.78.218.119 port 49628 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.174
country_id: 6252001
description:
Nov  9 04:22:57 host2 pure-ftpd[1566544]: (?@135.237.125.174) [INFO] New connection from 135.237.125.174


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:22:46 host2 sshd[1566308]: Disconnected from invalid user tobi 103.210.22.17 port 59644 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:24:12 host2 sshd[1568501]: Disconnected from invalid user dong 103.210.22.17 port 56586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 04:25:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xlaVMB1D7ukv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:25:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C1YmMR1DEOxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:25:37 host2 sshd[1570914]: Disconnected from invalid user precious 103.210.22.17 port 56990 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.214.122.74
country_id: 357994
description:
Nov  9 04:27:23 host2 pure-ftpd[1573463]: (?@188.214.122.74) [INFO] New connection from 188.214.122.74


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.13
country_id: 1227603
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.40.13, lip=66.85.158.91, TLS, session=<LcXQOB1D4NBinygN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.12
country_id: 130758
description:
Nov  9 04:27:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=62.133.46.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<C/jjOB1DVOI+hS4M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.135
country_id: 1643084
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.135, lip=66.85.158.91, session=<gZLLOB1DjMOt78mH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.151
country_id: 1522867
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=62.133.47.151, lip=66.85.158.91, session=<jS/IOB1D6Ik+hS+X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.238
country_id: 3144096
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.97.238, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I5DPOB1DIu25/WHu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.140
country_id: 1814991
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.140, lip=66.85.158.91, session=<C7DMOB1DoT688VCM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.139
country_id: 783754
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.139, lip=66.85.158.91, session=<etnPOB1D2qYfq5iL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:28:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<sWzTOx1DNJhK4fqm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.41
country_id: 6252001
description:
Nov  9 04:29:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.41, lip=66.85.158.92, session=<UdT/Ph1Dxr+synYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:31:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<8WUSRh1DqsxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:31:46 host2 sshd[1580458]: Disconnected from invalid user lcx 45.78.216.136 port 38882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-09 04:35:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unmorang) [87.103.126.54]:44654: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-11-09 04:35:43 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (mings) [71.229.43.123]:34910: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:36:51 host2 sshd[1588309]: Disconnected from invalid user public 45.78.216.136 port 56718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 04:36:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56994: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:36:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<KRovWR1D4Otm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:37:14 host2 sshd[1588925]: Disconnected from invalid user gabriele 45.78.218.119 port 54940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.107.25
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.107.25, lip=66.85.158.91, session=<Jd5+Wx1Dh32d5msZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, session=<U9CEWx1D7jqhI8Fx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:37:11 host2 sshd[1588808]: Disconnected from invalid user arkserver 101.47.142.27 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:39:51 host2 sshd[1592127]: Disconnected from invalid user bitrix 101.47.142.27 port 42562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 04:40:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<gVCZZh1DpIgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 04:41:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<rpphah1DWh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 04:42:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<q3DRbB1D+rVn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-09 04:42:14 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:59362: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-09 04:42:24 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:49446: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:42:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7yELbx1DsCmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 04:46:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<r+Vjex1DQqjRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 04:46:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<o+0Xfh1DmtRA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:50:38 host2 sshd[1606937]: Disconnected from invalid user wjx 45.78.218.119 port 51600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<UWDnjB1DirKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<HLbmjB1DJI8rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:51:58 host2 sshd[1608762]: Disconnected from invalid user user 2.57.121.25 port 27404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 04:52:12 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Pio9kR1DSL5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:53:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<fUNwlR1DOoaxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 04:54:17 host2 sshd[1614095]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 04:54:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Vg7AmB1D0pZCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 04:56:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<YOhloB1DuOxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 04:58:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6e2Epx1DvtkvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:59:27 host2 sshd[1621275]: Disconnected from invalid user user 2.57.121.25 port 25625 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.160
country_id: 3469034
description:
Nov  9 05:00:24 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.44.96.160, lip=66.85.158.91, TLS, session=<zVKrrR1DBKyxLGCg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.91
country_id: 3865483
description:
Nov  9 05:00:45 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.0.184.91, lip=66.85.158.91, TLS, session=<mpzZrh1D1dOKALhb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-09 05:02:55 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:57259: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-09 05:03:26 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:42796: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 05:03:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<flqvuh1DfIBD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 05:04:45 host2 sshd[1627153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 05:09:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<RyEOzx1DAokv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:11:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<64fe1h1DbKhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:13:02 host2 sshd[1636338]: Disconnected from invalid user laci 200.44.190.194 port 47190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:12:10 host2 sshd[1635433]: Disconnected from invalid user min 102.210.148.92 port 34030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:12:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<jNv+2R1D6jWYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-09 05:14:27 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:60124: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-09 05:14:35 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:54204: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:15:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<aMIl4x1DfKGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 05:14:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<vJIW4B1D3s8r4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:16:46 host2 sshd[1640687]: Disconnected from invalid user devuser 200.44.190.194 port 47942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:18:16 host2 sshd[1642266]: Disconnected from invalid user sshuser 102.210.148.92 port 37066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 05:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<uq367R1DELJnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:21:33 host2 sshd[1645746]: Disconnected from invalid user dave 86.107.77.118 port 46912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  9 05:24:17 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, TLS, session=<51klBB5DQNCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:25:27 host2 sshd[1649880]: Disconnected from invalid user ken 43.135.75.196 port 46974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-09 05:25:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (pication) [71.62.34.216]:47668: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:27:04 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6tv6DR5DiItnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:27:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<ttGKDx5DvD0v7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:28:06 host2 sshd[1652608]: Disconnected from invalid user localhost 43.135.75.196 port 51802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:27:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c9obDh5DfORm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:27:08 host2 sshd[1651658]: Disconnected from invalid user ftpuser 86.107.77.118 port 47382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-09 05:28:35 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:28444: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:29:24 host2 sshd[1654566]: Disconnected from invalid user support 43.135.75.196 port 54194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:32:00 host2 sshd[1657587]: Disconnected from invalid user orca 43.135.75.196 port 59048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 05:31:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<VX1bHR5DFuYv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-11-09 05:34:02 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:50096: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-09 05:34:27 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:21251: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Nov  9 05:36:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.224, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mZeCMB5D48TN0h/g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:38:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<qEPgNR5DJqZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:38:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<0TmJNh5D3M9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:40:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<9nLJPB5Dsu1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:41:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<i9enQB5DgAcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 05:46:28 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<BP9OUx5DaMZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:50:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8mskYB5DBFaYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:58 host2 pure-ftpd[1679986]: (?@195.178.110.160) [INFO] New connection from 195.178.110.160


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, session=<HfidYx5DuIHDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 05:52:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<7TgnZx5DyL+l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:51:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, TLS, session=<TfNHZB5DdobDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:54:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<u/NHcB5DNuexiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 05:54:58 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<L7a3cR5DWp1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-11-09 05:55:28 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:47834: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-09 05:55:40 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:44992: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 05:58:55 host2 sshd[1689105]: Disconnected from invalid user lara 62.60.131.157 port 57578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 06:00:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<I2xihh5DVoQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.234
country_id: 3469034
description:
Nov  9 06:00:49 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training@v-deploy.com>, method=PLAIN, rip=186.209.247.234, lip=66.85.158.91, TLS, session=<gFSAhR5DKbm60ffq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.144.164
country_id: 690791
description:
Nov  9 06:01:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training>, method=PLAIN, rip=37.221.144.164, lip=66.85.158.91, TLS, session=<f4Bthx5DCM8l3ZCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 06:03:46 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2P0qkR5DGMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.125
country_id: 3175395
description:
Nov  9 06:04:15 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.197.8.125, lip=66.85.158.91, TLS, session=<QVcVkh5DQs25xQh9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.47
country_id: 2963597
description:
Nov  9 06:04:34 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.106.141.47, lip=66.85.158.91, TLS, session=<bBImkx5Dla1Zao0v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 06:05:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<QpsPlh5DmNJCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 06:15:48 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<8z5DvB5DFLSxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 06:15:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<eIY5uh5DIKo+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.193.34
country_id: 2921044
description:
Nov  9 06:17:39 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.128.193.34, lip=66.85.158.91, session=<xIX+wh5Du0yygMEi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.232.238
country_id: 2921044
description:
Nov  9 06:17:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.232.238, lip=66.85.158.91, session=<zmMLwx5Dfg3RJuju>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-09 06:18:12 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:41398: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 06:20:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<GfeGzR5D2GKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 06:21:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<L6L0zx5DyrlK4fqm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.91
country_id: 6252001
description:
Nov  9 06:23:47 host2 pure-ftpd[1718211]: (?@199.45.155.91) [INFO] New connection from 199.45.155.91


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:24:09 host2 sshd[1718656]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:24:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ptky3R5DXukDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:25:56 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<DR6V4B5D5OQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-11-09 06:27:02 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:38183: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:27:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vojY5h5D1ooDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-09 06:27:12 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:55158: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:28:28 host2 sshd[1723619]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:28:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<1hTa6h5D3KwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:30:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5lzc7x5DULQDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:30:55 host2 sshd[1727060]: Disconnected from invalid user base 43.153.39.178 port 55298 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:31:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<b/Uw9R5DGu0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:33:15 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<WeHG+h5DGJYDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:33:34 host2 sshd[1730297]: Disconnected from invalid user maman 43.153.39.178 port 34508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  9 06:34:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<sdPs/R5DSsEDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:34:44 host2 sshd[1731512]: Disconnected from invalid user jjq 43.153.39.178 port 37794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-11-09 06:36:07 dovecot_login authenticator failed for (nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:55462: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-11-09 06:36:18 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:48098: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 06:36:55 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<10/JBx9D2JlnoNQc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 06:38:55 host2 sshd[1736504]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:38:20 host2 sshd[1735962]: Disconnected from invalid user db2inst1 43.153.39.178 port 47676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.39.178
country_id: 6252001
description:
Nov  9 06:40:43 host2 sshd[1738709]: Disconnected from invalid user user 43.153.39.178 port 53894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 06:48:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<hi59Lx9DxNtK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 06:50:53 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<fPe6OR9Dso5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 06:52:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<BMzVPR9D3NZn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.241.3
country_id: 6252001
description:
Nov  9 06:57:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.12.241.3, lip=66.85.158.92, session=<rg81UR9DWOQUDPED>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-09 06:58:44 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (unper) [68.60.77.128]:34834: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 06:58:57 host2 sshd[1759905]: Disconnected from invalid user user 2.57.121.25 port 41837 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.37
country_id: 3175395
description:
Nov  9 07:00:05 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.37, lip=66.85.158.91, TLS, session=<AzmwWR9DyLDZGrMl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.66
country_id: 298795
description:
Nov  9 07:00:23 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.66, lip=66.85.158.91, TLS, session=<liHLWh9D2IZfACBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 07:00:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<gOI/XB9Dqrwv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov  9 07:02:31 host2 pure-ftpd[1764871]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-09 07:02:48 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40712: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-11-09 07:02:59 dovecot_login authenticator failed for ([203.124.44.231]) [203.124.44.231]:45825: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:05:21 host2 sshd[1769016]: Disconnected from invalid user s1 193.163.72.91 port 40654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 07:05:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<vbV5bR9D/M9A44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:09:03 host2 sshd[1773168]: Disconnected from invalid user marcus 193.163.72.91 port 40316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.163.72.91
country_id: 298795
description:
Nov  9 07:12:51 host2 sshd[1777368]: Disconnected from invalid user cassandra 193.163.72.91 port 46822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.106
country_id: 1880251
description:
Nov  9 07:13:36 host2 sshd[1778178]: Disconnected from invalid user cassandra 45.78.220.106 port 35330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 07:14:24 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<56PTjR9DoIYv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 07:16:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<R5ewlR9DisBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 07:16:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<+xi/lR9DIptCYSpH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  9 07:17:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.91, TLS, session=<e6Pzlx9D9o1ChJl2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.220.106
country_id: 1880251
description:
Nov  9 07:18:42 host2 sshd[1783921]: Disconnected from invalid user ai 45.78.220.106 port 57202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 07:19:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6AfooB9DxuovT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.89
country_id: 6252001
description:
Nov  9 07:25:43 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.89, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ho5mth9DtcLN0h9Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.203.125
country_id: 6252001
description:
Nov  9 07:27:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.203.125, lip=66.85.158.91, session=<C9PyvR9D/LtK68t9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 07:30:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<hu7exh9D/N8+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-09 07:32:04 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:56394: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 07:31:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<ok/xyR9Dco1K4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.26
country_id: 1733045
description:
2025-11-09 07:32:46 dovecot_login authenticator failed for ([49.124.153.26]) [49.124.153.26]:38744: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.135.32
country_id: 1269750
description:
Nov  9 07:36:17 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=143.244.135.32, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Jasr3B9DyN+P9Icg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2025-11-09 07:41:41 dovecot_login authenticator failed for ([49.124.153.8]) [49.124.153.8]:55794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-11-09 07:41:52 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:34352: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-09 07:42:55 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:54885: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-09 07:42:38 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:43112: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-11-09 07:47:25 dovecot_plain authenticator failed for (toiddynal) [96.85.104.2]:37212: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.216.67.37
country_id: 1861060
description:
Nov  9 07:55:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.216.67.37, lip=66.85.158.91, session=<4Q1wHyBDyq4I2EMl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.208
country_id: 3865483
description:
Nov  9 07:55:46 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=186.190.167.208, lip=66.85.158.91, TLS, session=<MTCuICBD6q66vqfQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.131
country_id: 6290252
description:
Nov  9 07:56:04 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.97.131, lip=66.85.158.91, TLS, session=<Bk7yISBD+71tzmGD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 07:58:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<juxSKiBDDNxK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 08:02:46 host2 sshd[1836712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov  9 08:07:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sDOqSiBDktjG6xhl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.146
country_id: 2635167
description:
Nov  9 08:09:01 host2 dovecot[1509044]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.146, lip=66.85.158.92, TLS, session=<pHRFUSBDa9a594mS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 08:13:15 host2 sshd[1849770]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.5.158
country_id: 290557
description:
2025-11-09 08:13:38 dovecot_plain authenticator failed for (symneecon) [5.31.5.158]:35677: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-09 08:13:41 dovecot_plain authenticator failed for (mormalval) [102.53.15.18]:60826: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-09 08:13:20 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:35794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-09 08:13:29 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:55071: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 08:16:12 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50096: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Nov  9 08:26:07 host2 sshd[1865161]: Disconnected from invalid user hugo 103.118.114.22 port 41580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 08:30:31 host2 sshd[1871091]: Disconnected from invalid user jovan 62.60.131.157 port 10032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 08:33:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 22 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<pKODqCBD2jgv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-11-09 08:33:48 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:42059: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.124
country_id: 2186224
description:
2025-11-09 08:33:59 dovecot_login authenticator failed for ([121.73.169.124]) [121.73.169.124]:55910: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:34:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<FzWVqyBD2KEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:35:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9wYKsSBDBNYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:36:14 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<gxibsiBDeuEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:37:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aYLxtSBD8pYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-09 08:38:34 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:53204: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:38:39 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nRA7uyBDXJsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-09 08:38:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46069: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:40:02 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<v7MswCBDDrMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:40:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Y5yhwCBDps4DhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  9 08:40:42 host2 pure-ftpd[1882817]: (?@87.236.176.215) [INFO] New connection from 87.236.176.215


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 08:42:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uEq6xyBDrOpK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 08:47:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<smdm2yBDMgQv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov  9 08:49:47 host2 pure-ftpd[1895049]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:50:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MdCh5iBDMc+TuYVJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.83
country_id: 6252001
description:
Nov  9 08:51:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.83, lip=66.85.158.91, TLS, session=<LDbo6SBD6vzG6xhT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:51:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<xlvS6iBDXPGTuYVJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-09 08:58:20 dovecot_plain authenticator failed for (spinally) [102.53.15.17]:50478: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.73
country_id: 6252001
description:
Nov  9 08:58:48 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.73, lip=66.85.158.92, TLS, session=<fLlOAyFDUveTuYVJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 08:59:13 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<fEfHBCFD+p0DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 09:00:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<j3k4CSFDCJg+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:00:43 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<eNEfCiFDDssDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:02:33 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<3Re6ECFDxIQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:04:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<dm9kFiFDYo0DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:04:22 host2 dovecot[1509044]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<VgU6FyFD4rUDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:05:55 host2 dovecot[1509044]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<qjXDHCFDlpYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:05:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<LMztGyFDyJoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:06:12 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<QDjHHSFDxN4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.71
country_id: 6252001
description:
Nov  9 09:06:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mVtVHyFDhNQtT89H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Nov  9 09:06:51 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.92, TLS, session=<hfwZICFDtEnAm1p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 09:07:45 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Nk9JIyFDeLwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  9 09:08:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+SEzJiFDfOvUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-11-09 09:10:11 dovecot_login authenticator failed for (red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:35942: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-09 09:10:36 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:36328: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-09 09:15:53 dovecot_plain authenticator failed for (tuophiprew) [5.32.99.14]:37442: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-09 09:15:55 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (whisopils) [76.145.10.140]:41992: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.33.221
country_id: 6252001
description:
Nov  9 09:18:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.33.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<n7dOSCFDEJIUoyHd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 09:20:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<H55EUCFD3JU+PIOL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.231.116
country_id: 1861060
description:
Nov  9 09:21:57 host2 pure-ftpd[1932471]: (?@165.154.231.116) [INFO] New connection from 165.154.231.116


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:23:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<I2d1XCFDEtIjy9JW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:24:13 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fkU3XiFDiPUjy9JW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-09 09:27:16 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:40366: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-09 09:27:26 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:18143: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-09 09:28:58 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:35588: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-09 09:29:13 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:50500: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.119.112.180
country_id: 6252001
description:
Nov  9 09:29:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.119.112.180, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5F6FcSFDrqOHd3C0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.86
country_id: 2635167
description:
Nov  9 09:31:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.86, lip=66.85.158.91, TLS, session=<BcQueCFDMPwjy9JW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.148.189
country_id: 690791
description:
Nov  9 09:32:48 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.148.189, lip=66.85.158.91, TLS, session=<bAHqeyFD5aUl3ZS9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.159.117
country_id: 99237
description:
Nov  9 09:32:31 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=65.20.159.117, lip=66.85.158.91, TLS, session=<Ym7NeiFDrKZBFJ91>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.38.104.3
country_id: 3017382
description:
[2025-11-09 09:43:44 +0530] info [cpaneld] 51.38.104.3 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.92
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.92: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-09 09:51:54 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:46970: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-09 09:52:03 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:46914: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.251.41
country_id: 1819730
description:
Nov  9 09:53:27 host2 sshd[1969988]: Disconnected from invalid user alves 152.32.251.41 port 53836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.89.98.120
country_id: 1282988
description:
Nov  9 09:57:54 host2 sshd[1975465]: Disconnected from invalid user talked 120.89.98.120 port 37706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.89.98.120
country_id: 1282988
description:
Nov  9 10:02:24 host2 sshd[1981533]: Disconnected from invalid user pedrito 120.89.98.120 port 39812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 10:06:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<MA1l9iFDlr4v7AMK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.42
country_id: 6252001
description:
Nov  9 10:07:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.42, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZT2Q+iFDyc7N0h8q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-09 10:14:52 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:33640: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-09 10:15:03 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:57954: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-11-09 10:15:02 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (noliss) [76.31.164.124]:34686: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 10:19:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<xt/rIyJDOIUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 10:28:09 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<BLS7QiJDWMg+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 10:27:19 host2 sshd[2010781]: Disconnected from invalid user user 2.57.121.25 port 10612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-09 10:27:31 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:40180: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-09 10:27:43 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:50544: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.243.218.218
country_id: 2921044
description:
[2025-11-09 10:35:51 +0530] info [cpaneld] 136.243.218.218 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:14 host2 sshd[2024385]: error: maximum authentication attempts exceeded for root from 91.170.247.160 port 6947 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:14 host2 sshd[2024385]: Disconnecting authenticating user root 91.170.247.160 port 6947: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:21 host2 sshd[2024473]: error: maximum authentication attempts exceeded for invalid user admin from 91.170.247.160 port 7432 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.170.247.160
country_id: 3017382
description:
Nov  9 10:38:23 host2 sshd[2024543]: Disconnecting invalid user admin 91.170.247.160 port 8196: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.70
country_id: 2510769
description:
2025-11-09 10:40:27 dovecot_login authenticator failed for (bPpH50rGE) [98.98.171.70]:54337: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.171.70
country_id: 2510769
description:
2025-11-09 10:41:15 dovecot_login authenticator failed for (siQzbjMK) [98.98.171.70]:57559: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-09 10:48:25 dovecot_plain authenticator failed for (veralic) [65.20.250.163]:56769: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.243.97
country_id: 798544
description:
Nov  9 10:51:40 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=109.125.243.97, lip=66.85.158.91, TLS, session=<7dbwlSJDqIdtffNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.187
country_id: 953987
description:
Nov  9 10:52:02 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.45.187, lip=66.85.158.91, TLS, session=<bm0ZlyJDhJZmQC27>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-09 10:56:32 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:21190: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-09 10:56:46 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:54598: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 10:58:39 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Z6jBryJD4qY+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:04:41 host2 sshd[2056651]: Disconnected from invalid user branch 101.47.49.171 port 48242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.102
country_id: 3469034
description:
Nov  9 11:12:12 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.186.197.102, lip=66.85.158.91, TLS, session=<i91M3yJDTpqKusVm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.158
country_id: 2510769
description:
Nov  9 11:11:52 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.143.92.158, lip=66.85.158.91, TLS, session=<Xj4z3iJDANS5j1ye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.118
country_id: 6252001
description:
Nov  9 11:11:59 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.188.118, lip=66.85.158.91, session=<4w+S3yJDyJMs3Lx2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-09 11:15:54 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:42419: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:17:11 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8kg38iJD+OIDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-09 11:16:30 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:59496: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:17:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<VnKO8iJD8IYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-09 11:17:35 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (covalied) [174.59.253.88]:60848: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:18:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Iusc9iJDqoMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:19:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<r+1K+yJDRucDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:19:55 host2 sshd[2074584]: Disconnected from invalid user testuser 101.47.49.171 port 34570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:20:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<W0DG/iJD2NoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:21:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<rvkzAiNDWo8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:22:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rgLtBSNDRJsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:24:02 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<awS3CiNDwtkDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 11:23:14 host2 sshd[2078544]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:24:28 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EcA+DCNDttMDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.171
country_id: 1880251
description:
Nov  9 11:24:56 host2 sshd[2080260]: Disconnected from invalid user jayanthi 101.47.49.171 port 33510 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  9 11:25:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<UowSECND/MYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 11:31:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<QmLmJiNDNBwv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-09 11:36:06 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:53418: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.30
country_id: 1168579
description:
2025-11-09 11:36:25 dovecot_login authenticator failed for (30.92.zcomnetworks.com.pk) [103.148.92.30]:35134: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-09 11:38:27 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:33177: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-09 11:38:43 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:54213: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 11:45:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<ZcP9VSNDWt8v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 11:45:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<zAuSViNDUNg+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.200
country_id: 6252001
description:
Nov  9 11:56:01 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.200, lip=66.85.158.91, TLS, session=<KcMLfSNDdOjG6xjI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 11:55:25 host2 sshd[2118150]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 11:57:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57563: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.21.193
country_id: 2077456
description:
[2025-11-09 11:59:27 +0530] info [cpaneld] 209.38.21.193 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-09 12:02:41 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:62479: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-09 12:02:54 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:48638: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.134.161.95
country_id: 1227603
description:
Nov  9 12:08:35 host2 pure-ftpd[2133648]: (?@112.134.161.95) [INFO] New connection from 112.134.161.95


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.140.174
country_id: 2245662
description:
Nov  9 12:10:37 host2 sshd[2136087]: Disconnected from invalid user komatsu 154.125.140.174 port 43113 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 112.134.161.95
country_id: 1227603
description:
Nov  9 12:14:14 host2 pure-ftpd[2140812]: (?@112.134.161.95) [INFO] New connection from 112.134.161.95


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 12:15:16 host2 sshd[2141954]: Disconnected from invalid user user 2.57.121.25 port 10425 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-09 12:18:21 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:35073: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 12:18:29 host2 sshd[2145425]: Disconnected from invalid user octavio 62.60.131.157 port 56084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2025-11-09 12:18:45 dovecot_login authenticator failed for ([49.124.151.21]) [49.124.151.21]:60492: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov  9 12:25:33 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wnys5iNDi9TN0h/f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:31:04 host2 sshd[2160734]: Disconnected from invalid user sfserver 47.253.53.123 port 38738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:31:27 host2 sshd[2161115]: Disconnected from invalid user zeshan 107.172.151.218 port 59462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:36:09 host2 sshd[2166090]: Disconnected from invalid user oracle 47.253.53.123 port 34756 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.103.133
country_id: 6252001
description:
Nov  9 12:36:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.103.133, lip=66.85.158.92, session=<+p4QDSRDVMgtOGeF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:37:20 host2 sshd[2167373]: Disconnected from invalid user ubuntu 107.172.151.218 port 56722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:38:37 host2 sshd[2168618]: Disconnected from invalid user ts3server 107.172.151.218 port 58318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.53.123
country_id: 6252001
description:
Nov  9 12:40:05 host2 sshd[2170374]: Disconnected from invalid user mary 47.253.53.123 port 46214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.151.218
country_id: 6252001
description:
Nov  9 12:39:59 host2 sshd[2169984]: Disconnected from invalid user ubuntu 107.172.151.218 port 43768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.234
country_id: 6252001
description:
Nov  9 12:41:41 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.234, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KUhkICRDXMuTuYTq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Nov  9 12:42:08 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.94, lip=66.85.158.91, TLS, session=<BBT6ISRDGEUtT7Ve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 12:41:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<9UWEHyRDMrE+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-11-09 12:43:24 dovecot_login authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:49568: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-09 12:43:35 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:55386: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-09 12:44:14 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:59299: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-09 12:44:34 dovecot_login authenticator failed for ([27.123.98.174]) [27.123.98.174]:37130: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 12:49:58 host2 sshd[2183419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-09 12:52:09 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:60573: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-09 12:51:53 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:33192: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 12:57:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<jrYWWSRDvHsv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-09 12:58:49 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:54793: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-09 12:59:19 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:37609: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-11-09 13:04:50 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  9 13:05:16 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<IXC2dCRD2L1ChJl7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:05:42 host2 sshd[2203586]: Disconnected from invalid user flussonic 186.209.77.235 port 54549 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-11-09 13:06:56 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:34187: 535 Incorrect authentication data (set_id=tech@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-09 13:07:41 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:54326: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:10:11 host2 sshd[2208691]: Disconnected from invalid user cs2server 186.209.77.235 port 41764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.235
country_id: 3469034
description:
Nov  9 13:13:15 host2 sshd[2211981]: Disconnected from invalid user brian 186.209.77.235 port 42647 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Nov  9 13:17:57 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<fe4doSRDEo6Af15N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.128.149
country_id: 3469034
description:
2025-11-09 13:19:09 dovecot_login authenticator failed for (189.115.128.149.static.host.gvt.net.br) [189.115.128.149]:45274: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.2
country_id: 953987
description:
Nov  9 13:18:19 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.2, lip=66.85.158.91, TLS, session=<dgU8oiRDzONmgTkC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.97.6
country_id: 1269750
description:
2025-11-09 13:19:37 dovecot_login authenticator failed for ([182.66.66.113]) [122.185.97.6]:36136: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 13:22:06 host2 sshd[2222523]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.52
country_id: 2635167
description:
2025-11-09 13:25:28 dovecot_plain authenticator failed for ([23.132.164.52]) [23.132.164.52]:60210: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  9 13:30:05 host2 sshd[2232265]: Disconnected from invalid user isabela 62.60.131.157 port 25988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  9 13:32:33 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<e2RT1iRDyDS4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.159
country_id: 6252001
description:
Nov  9 13:32:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.159, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CPTN1iRDCZtBMQGf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov  9 13:33:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=</tLu1yRD/hdBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov  9 13:33:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS: Connection closed, session=<F3PF2CRDMopBMQGY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-09 13:40:57 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:51946: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-11-09 13:41:32 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:47579: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-09 13:49:31 dovecot_plain authenticator failed for (kafidly) [65.20.148.165]:35708: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-09 13:49:34 dovecot_plain authenticator failed for (patoe) [92.62.243.174]:36660: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.116
country_id: 6252001
description:
Nov  9 13:49:47 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.116, lip=66.85.158.92, session=<6KzqEyVDwO3G6xh0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 13:56:56 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<T91ZLSVDTuM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.154.205.102
country_id: 2510769
description:
Nov  9 14:02:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.154.205.102, lip=66.85.158.91, TLS, session=<Qho0PyVDzIG5ms1m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.163
country_id: 3469034
description:
Nov  9 14:02:29 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=187.120.72.163, lip=66.85.158.91, TLS, session=<bghSQCVD0Jq7eEij>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:09:17 host2 sshd[2278295]: Disconnected from invalid user liran 152.32.130.118 port 47336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-09 14:09:55 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:58518: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-09 14:10:07 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:36765: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:13:59 host2 sshd[2283265]: Disconnected from invalid user pooja 152.32.134.231 port 45634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:15:36 host2 sshd[2285370]: Disconnected from invalid user wujiawei 152.32.130.118 port 36530 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 14:16:18 host2 sshd[2287178]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:16:35 host2 sshd[2287543]: Disconnected from invalid user admin 152.32.134.231 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Nov  9 14:17:52 host2 sshd[2289135]: Disconnected from invalid user user 152.32.134.231 port 44898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:20:34 host2 sshd[2292500]: Disconnected from invalid user herman 152.32.130.118 port 57426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov  9 14:21:52 host2 sshd[2294124]: Disconnected from invalid user crafty 152.32.130.118 port 56940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.251.132.2
country_id: 3996063
description:
Nov  9 14:29:45 host2 sshd[2304334]: Disconnected from invalid user git 187.251.132.2 port 34422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-09 14:34:06 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:52913: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-09 14:34:18 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:35659: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-09 14:36:02 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (quorec) [68.52.119.193]:36184: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.251.132.2
country_id: 3996063
description:
Nov  9 14:44:01 host2 sshd[2321019]: Disconnected from invalid user vpn 187.251.132.2 port 41570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Nov  9 14:45:07 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.92, TLS, session=<dxrP2SVDfu2TuYQt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-11-09 14:45:41 dovecot_login authenticator failed for ([49.124.153.24]) [49.124.153.24]:45422: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-09 14:46:02 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:43412: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 14:46:24 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<xBhL3iVD9os+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-11-09 14:48:09 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:62468: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 14:48:22 host2 sshd[2326445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-09 14:48:30 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:58547: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-09 14:54:17 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:23955: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-09 14:54:37 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:38204: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-09 15:04:44 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:52528: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-09 15:04:53 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:58046: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:06:47 host2 sshd[2349014]: Disconnected from invalid user jenkins 179.40.112.10 port 49226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Nov  9 15:08:13 host2 sshd[2350552]: Disconnected from invalid user tempuser 106.51.1.63 port 32972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:08:30 host2 sshd[2350840]: Disconnected from invalid user postgres 179.40.112.10 port 53152 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:11:11 host2 sshd[2353969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:11:34 host2 sshd[2354474]: Disconnected from invalid user prtg 179.40.112.10 port 60972 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:11:20 host2 sshd[2354125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-09 15:15:54 dovecot_plain authenticator failed for (unhamon) [64.53.7.231]:54236: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:17:44 host2 sshd[2362732]: Disconnected from invalid user production 179.40.112.10 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:18:54 host2 sshd[2364202]: Disconnected from invalid user git 185.213.164.17 port 36530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-09 15:19:28 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:49197: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-09 15:19:52 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:51244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:20:14 host2 sshd[2365913]: Disconnected from invalid user ali 185.213.164.17 port 54826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Nov  9 15:21:05 host2 sshd[2366910]: Disconnected from invalid user openbravo 179.40.112.10 port 56212 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.164.17
country_id: 130758
description:
Nov  9 15:21:30 host2 sshd[2367380]: Disconnected from invalid user laravel 185.213.164.17 port 45466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.15
country_id: 3175395
description:
Nov  9 15:24:30 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=185.15.170.15, lip=66.85.158.91, TLS, session=<CZqqZSZDlZG5D6oP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.165
country_id: 953987
description:
Nov  9 15:24:53 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.56.165, lip=66.85.158.91, TLS, session=<263TZiZDnKtmgTil>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.146.204
country_id: 6252001
description:
Nov  9 15:31:50 host2 pure-ftpd[2381508]: (?@146.190.146.204) [INFO] New connection from 146.190.146.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 15:32:18 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56392: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-09 15:38:00 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:58354: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-09 15:38:17 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:38596: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 15:39:55 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<TLmonSZDmtA+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:42:03 host2 sshd[2393030]: Disconnected from invalid user yt 191.210.70.23 port 48797 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 15:42:43 host2 sshd[2393637]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 15:49:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<Ki3rvyZDCL8+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-09 15:50:48 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:42944: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-09 15:50:58 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:59629: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:54:08 host2 sshd[2408119]: Disconnected from invalid user bpm 116.193.191.104 port 36620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:53:35 host2 sshd[2407247]: Disconnected from invalid user admin 191.210.70.23 port 54537 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.210.70.23
country_id: 3469034
description:
Nov  9 15:55:44 host2 sshd[2409972]: Disconnected from invalid user git 191.210.70.23 port 47955 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:55:46 host2 sshd[2409986]: Disconnected from invalid user admin 116.193.191.104 port 60072 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.207
country_id: 6252001
description:
Nov  9 16:00:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.207, lip=66.85.158.92, TLS, session=<C9YX5iZDOPCTuYTP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.104
country_id: 1643084
description:
Nov  9 15:59:11 host2 sshd[2414755]: Disconnected from invalid user admin 116.193.191.104 port 53166 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Nov  9 16:04:30 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<KN299SZD7INChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-09 16:05:32 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:33156: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-09 16:05:48 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:39029: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-09 16:06:01 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:52662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-09 16:06:13 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:57975: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.38.21.193
country_id: 2077456
description:
[2025-11-09 16:06:14 +0530] info [cpaneld] 209.38.21.193 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 16:14:42 host2 sshd[2433635]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 16:17:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<585yIydD1NQ+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.186
country_id: 226074
description:
Nov  9 16:25:22 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=196.0.107.186, lip=66.85.158.91, TLS, session=<5W4lPydD6p3EAGu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.184.80.147
country_id: 3469034
description:
Nov  9 16:25:42 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.184.80.147, lip=66.85.158.91, TLS, session=<cyNxQCdD6OctuFCT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.209.118.254
country_id: 953987
description:
Nov  9 16:28:40 host2 sshd[2448214]: Disconnected from invalid user edu 102.209.118.254 port 47832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-09 16:29:41 dovecot_plain authenticator failed for (peters) [50.231.243.28]:53694: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


