# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 06:17:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<a+i6pQpD4LVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 06:18:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Of2/pgpDXOUv/WCP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.74
country_id: 6252001
description:
Nov  8 06:18:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eMXjpwpDONzG6xhK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 06:19:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<yNWPrApDHodnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 06:19:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ZOZYrQpDOMpm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 06:20:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<nWG6rQpDQvCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 06:23:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<06czuwpD3IEv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 06:23:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<59kfuwpDSpmc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 06:23:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<7y5muwpDDIYr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-08 06:24:40 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:41478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-08 06:25:22 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:56076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 06:26:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<IFr8xApDlM0BFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 06:26:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<fuk3wwpD9KjRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 06:26:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<e4+HwwpDLpo+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 06:26:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Dmb3xQpDZpRCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 06:27:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<SxyayQpD5tQvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 06:30:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<HVwi0wpD/oNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 06:31:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<MGQv1wpDuOaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 06:32:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<DS3/2gpD1NsrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 06:34:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<wW+O4ApDnL+xiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 06:33:46 host2 sshd[16794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 06:34:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=</5FR4QpD/OhnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 06:35:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<stv25ApDhoAzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 06:35:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3fCR5QpDjIwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 06:35:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<DvC85QpDWKu2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 06:38:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<be5p7wpDNOSd5hjP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 06:40:36 host2 sshd[24498]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 06:40:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<9iw79QpDjKlK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 06:40:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<krjr9QpDMAVn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 06:42:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<DLjo/gpDEr2UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 06:45:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<fzsPBwtDANOOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:46:36 host2 sshd[30950]: Disconnected from invalid user jumpserver 162.240.39.179 port 37974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 06:45:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<a+xWCgtDxpFnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 06:47:06 host2 sshd[31433]: Disconnected from invalid user mohit 45.78.217.139 port 58618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 06:48:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bfOjEgtDXtKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 06:48:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<5eF6EwtDNKdn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2025-11-08 06:49:24 dovecot_login authenticator failed for ([45.182.5.96]) [45.182.5.98]:59853: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-08 06:49:53 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57319: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 06:50:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<PNDWGgtD6KUvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 06:51:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JjgLHgtDJpOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 06:51:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<nFsdHgtDjtNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 06:51:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=</MpIHgtD3s9nPeGp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-08 06:51:34 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:41296: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-08 06:51:06 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:53681: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 06:51:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BjRaHQtDfI+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 06:52:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<05Y1IgtD9jSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 06:53:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<scv6JQtD6MGi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 06:54:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<hkLdJwtDYqEz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:54:25 host2 sshd[39314]: Disconnected from invalid user nextcloud 162.240.39.179 port 37894 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.221.100
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 193.233.221.100 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.228.182
country_id: 2635167
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.242.228.182 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.172.233
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 166.88.172.233 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.234.25
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.147.234.25 - accounts2@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 06:55:29 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<eQhNLAtDZKNK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 06:55:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<pJ8CKwtDwpBD2fSf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.167.180
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 199.96.167.180 - accounts2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user accounts2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.106.50
country_id: 294640
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.80.106.50 - lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech.com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.17.78
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 167.253.17.78 - administrator "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administrator (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 06:55:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<qSQNLQtDFsuxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 06:56:16 host2 sshd[41544]: Disconnected from invalid user misha 45.78.217.139 port 60242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:57:07 host2 sshd[42368]: Disconnected from invalid user stephen 162.240.39.179 port 39814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 06:57:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<eww/MgtDKGUv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:58:26 host2 sshd[43697]: Disconnected from invalid user roger 162.240.39.179 port 40762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-08 06:59:22 dovecot_plain authenticator failed for (essia) [65.20.147.45]:56434: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 06:59:55 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<RQ4vPAtDC3wvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:01:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<cOIZQQtD+MtD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 07:02:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<xUPORQtDYLRFPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 07:01:57 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<9Xp0QwtDlOo+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:02:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3LI2RgtD8uiP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 07:04:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<5O10TAtDlOqzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 07:06:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<VRcuUgtDGiwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.215.134.25
country_id: 3469034
description:
Nov  8 07:06:19 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=181.215.134.25, lip=66.85.158.91, session=<XhMVUwtDZIy114YZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.92.189
country_id: 3469034
description:
Nov  8 07:06:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=31.97.92.189, lip=66.85.158.91, session=<ILfsUwtDdJQfYVy9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 07:07:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<azvvVQtDpzFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 07:08:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<CHs/XAtDLulm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 07:09:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<BE3xXAtDrM9noNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 07:09:15 host2 sshd[55701]: Disconnected from invalid user labuser 45.78.217.139 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 07:12:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Ie5jagtDDJnRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Nov  8 07:13:26 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<n6FjawtDTNWxCPsq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:13:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<M0G6bAtDzoovT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 07:13:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<VtEpbQtDGJIBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 07:14:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<eMjvbgtDDLWl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 07:14:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<3TsvcAtDGqkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.101
country_id: 1269750
description:
Nov  8 07:13:47 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.101, lip=66.85.158.91, TLS, session=<BabAbAtDTaxnEqZl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 07:16:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<YnD3dwtDPMkv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 07:18:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<C5bOfQtDGL9nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 07:18:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<i/mAfgtDqOcvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 07:18:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UyzSfwtDZj+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 07:19:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<4F+mggtDQtdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 07:20:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<V9pjhQtDTuxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 07:20:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<Xz4DhgtDNpGc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 07:19:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<N60xgwtDPuhK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 07:19:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<DreGgwtDMqRIPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 07:20:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<1L6HhAtDOKMv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 07:21:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<b2qhiAtD4t/RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 07:22:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=</WwmjAtD1uYr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 07:27:24 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<V5NxngtD1rpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:28:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<lwDToAtDiJaP9IUv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.19.144.130
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.19.144.130 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov  8 07:30:17 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<k7PdqAtDLvhAPpyi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.106.59.202
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.106.59.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.0.74
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.185.0.74 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 07:30:22 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ObYTqQtDAtVm1bVi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.169.192
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.59.169.192 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.209.165.92
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.209.165.92 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.12.58
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.59.12.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.76.139.239
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.76.139.239 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov  8 07:30:51 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS: Connection closed, session=<ZYDvqgtDcA5APpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 07:30:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<fRGQqgtD9OcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 07:32:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<iqS/sQtDyoS2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 07:32:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<xYMPsgtDZNFnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 07:33:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<LKYHswtDyOQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 07:33:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<6FgItAtD1oAzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 07:34:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<VJz0uAtDGqyd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 07:35:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<szQsugtD+sGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:36:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<UkIvvgtDiJYvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 07:37:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<M5DLwQtDxKVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 07:39:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<0RaEyQtDlOpIPGU3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:40:39 host2 sshd[89287]: Disconnected from invalid user ems 125.22.249.36 port 39218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:42:18 host2 sshd[90867]: Disconnected from invalid user usuario 125.22.249.36 port 53690 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 07:42:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Ztuf1AtDCL+UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 07:43:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<j0M82AtDgKiPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:44:04 host2 sshd[92596]: Disconnected from invalid user beacon 125.22.249.36 port 39936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:45:14 host2 sshd[94367]: Disconnected from invalid user debian 107.175.228.153 port 44330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.253
country_id: 1269750
description:
Nov  8 07:45:37 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.55.105.253, lip=66.85.158.91, TLS, session=<1zOQ3gtDEO1nN2n9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.116
country_id: 953987
description:
Nov  8 07:45:59 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.51.116, lip=66.85.158.91, TLS, session=<67fj3wtDl9lmgTN0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 07:46:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<V94d4wtDdKiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 07:46:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<DnMr5AtDEtZnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 07:48:40 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<VrOF6gtDU9gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 07:49:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<4/o47gtDhLdn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:50:23 host2 sshd[99676]: Disconnected from invalid user stefanos 107.175.228.153 port 36146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 07:50:47 host2 sshd[99955]: Disconnected from invalid user test3 41.214.125.65 port 47075 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 07:51:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<MrUg9AtDOluYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:51:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<+Vl39AtD5oRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 07:51:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<J5X09AtDfIGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:51:41 host2 sshd[101016]: Disconnected from invalid user testuser 107.175.228.153 port 40864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  8 07:51:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<R3ko9gtDhsZChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 07:52:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xNyN+AtD2rhA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  8 07:53:02 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<KmhB+gtDOJ2LonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 07:53:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<oQ01+gtDQolnPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 07:53:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<tFNy+gtDBvFn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 07:53:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zPg+/QtDJT0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.116
country_id: 3469034
description:
Nov  8 07:54:44 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<training@v-deploy.com>, method=PLAIN, rip=191.53.130.116, lip=66.85.158.91, TLS, session=<tbOz/gtDDeK/NYJ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.233
country_id: 953987
description:
Nov  8 07:55:05 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=102.129.50.233, lip=66.85.158.91, TLS, session=<CL13AAxDccpmgTLp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 07:56:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<9brNBgxDiuWxiOOT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.206
country_id: 6252001
description:
Nov  8 07:56:36 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.206, lip=66.85.158.91, session=<cFUGBwxDUOHN0h/O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 07:56:55 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<3i4ECAxDBMgv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:57:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<3CbECgxDTLJD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.224.210
country_id: 1269750
description:
Nov  8 07:57:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=31.97.224.210, lip=66.85.158.91, session=<0M9pCwxDKLIfYeDS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 07:59:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<NiBFEQxDbNJK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 07:59:33 host2 sshd[109538]: Disconnected from invalid user christine 41.214.125.65 port 38998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:59:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xE+IEAxDkNyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:59:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<UqipEAxDqrsvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 08:01:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<QsbGFgxDLMQBFNmn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 08:04:11 host2 sshd[114503]: Disconnected from invalid user ubuntu 41.214.125.65 port 40482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 08:05:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<uMz5JAxDzoxm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 08:06:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<v8mLKAxD8o8v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 08:07:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Mz5FLgxDXAVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 08:06:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<jleDKwxD/umzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 08:09:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<tapINAxDEN9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 08:09:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<ZobQNAxDsKPRJvZG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Nov  8 08:09:31 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.244, lip=66.85.158.91, session=<bEk0NQxDe7jDuEz0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Nov  8 08:09:41 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.247, lip=66.85.158.91, session=<B4XPNQxDK9/DuEz3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.38
country_id: 6252001
description:
Nov  8 08:09:51 host2 dovecot[22732]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.38, lip=66.85.158.91, session=<K/tgNgxDG8vDuEwm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 08:11:24 host2 sshd[122467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 08:15:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<ZwDFSQxDWLMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 08:17:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<7ys/UAxDqIYv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 08:16:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<g3ocTQxDBJXRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 08:17:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<v/ExUQxDOI+l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 08:17:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<BUFqUgxDcuOc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 08:17:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<dNfnUgxDyGSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 08:18:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<RBFkVQxDVoVm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 08:18:15 host2 sshd[131686]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 08:19:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<HiPnWQxDJrYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 08:20:24 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<z8/5WwxDjItnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 08:20:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JlkpXQxDupFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 08:21:25 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<lX+hXwxDupUr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 08:22:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<zTVqYwxDQK0vT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-08 08:22:37 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (waspor) [73.161.96.107]:44046: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 08:23:57 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<rH2uaAxD3pBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 08:24:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<pr3+agxDOMKP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 08:28:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Lly0eQxDlwW2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 08:29:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<R8bRegxDEI8rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 08:29:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<hMC8ewxDeL5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 08:29:29 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<lUaAfAxD3q1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 08:31:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<pe8ShAxDIoEzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 08:31:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<IAxchAxDZJKd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 08:32:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<8bguhgxDnMJnJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.170.123.140
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 148.170.123.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 08:34:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<xI/vjgxDtq1K0NqG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.41.12.246
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.41.12.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.174.229.79
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.174.229.79 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 08:35:00 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OY48kAxDdM2xiOOT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.132.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 35.151.132.69 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 08:35:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<KhJtkgxDsscXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.7.106.169
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.7.106.169 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.184.53.217
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.184.53.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.64.203.99
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.64.203.99 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.134.169.106
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 112.134.169.106 - dimmithra "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user dimmithra (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Nov  8 08:37:39 host2 dovecot[22732]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS, session=<vcPTmQxDDspHBobn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 08:39:11 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<EG0vnwxDGIqi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 08:39:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Q0VQoAxDoK6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov  8 08:40:20 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<XhdZogxDu+jJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.118.44
country_id: 732800
description:
Nov  8 08:40:38 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=79.110.118.44, lip=66.85.158.91, TLS, session=<X/R4owxDrsZPbnYs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 08:41:27 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51780: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 08:42:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<l4imqQxDCOtIPGU3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 08:42:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<WTMpqwxDjMqPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 08:42:41 host2 sshd[159110]: Disconnected from invalid user user 2.57.121.25 port 10642 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 08:42:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<hWlKrAxDWOWUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 08:43:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<0W7CrgxDgZkz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 08:45:46 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<ESKwtgxDWoAvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 08:46:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<tTRbugxDVINnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 08:48:08 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<QG4vvwxDrttD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 08:48:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<YiyWwQxD5rc+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 08:48:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<fTWmwAxDMPkvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 08:48:40 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<DT4PwQxD4IgBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 08:49:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<1SBbxQxDELmOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 08:50:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<FYWkyAxDCoCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 08:51:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<aZmeywxD+sdn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 08:52:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</f6G0AxDBuCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 08:53:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<n1mT0QxDmJtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 08:55:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<+0sX2AxDLr5nPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 08:55:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<BAQ62wxDjtKP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 08:56:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<K7wu3QxDkJqxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 08:57:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<VFd34AxD5DIv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 09:02:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<iv6q8QxD3J5m1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 09:03:45 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<79oB9wxDesVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 09:06:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<x5YzAQ1DMvcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 09:07:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+25aAw1D1ilniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 09:07:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<lIHyAg1DaubRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 09:09:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<UcjVCg1DirgvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 09:09:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<OwTyCw1DssWzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 09:10:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<B+mcDg1D9O1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 09:11:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<x3YlEg1DnIXRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 09:11:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<MQjBEw1D6MArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 09:14:22 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<sxD/HA1DyMwv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 09:14:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<yjyOHQ1DgOUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 09:14:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<VCaRHg1DSLic7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 09:17:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Qod1KA1D9IiYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 09:17:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<FlZdKA1DntFm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.193
country_id: 1880251
description:
Nov  8 09:18:31 host2 sshd[202009]: Disconnected from invalid user odoo13 101.47.141.193 port 44994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 09:21:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<DHrjNA1DnO0r4TT5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.189
country_id: 6252001
description:
Nov  8 09:21:11 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.189, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pAx9NQ1DHtSTuYW9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 09:21:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3EY5Nw1DKtGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 09:22:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<P08sOQ1DsLQvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 09:21:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<gGbdNw1DUr5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 09:21:55 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<u/3+Nw1Dlt6l0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.189
country_id: 6252001
description:
Nov  8 09:22:11 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.189, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<rsAQOQ1DiuaTuYW9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 09:23:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gzgOPg1DoKdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 09:25:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<fCgpRQ1DEmq2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 09:27:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<ZEfqSg1DlIgrZDwA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.189
country_id: 6252001
description:
Nov  8 09:28:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.189, lip=66.85.158.91, TLS, session=<gVepTw1DSveTuYW9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.255
country_id: 1880251
description:
Nov  8 09:27:51 host2 sshd[211950]: Disconnected from invalid user odoo13 101.47.49.255 port 46440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 09:28:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<G7RyTw1DxLxK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 09:28:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<xoaMTw1D1tdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 09:29:19 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<Pul8Ug1DcoSd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 09:29:46 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<LGcYVA1DTIEzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.255
country_id: 1880251
description:
Nov  8 09:30:12 host2 sshd[214715]: Disconnected from invalid user ganesh 101.47.49.255 port 54310 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 09:31:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<9XauWg1DtqZnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 09:32:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<VrvDXA1DrpNK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 09:32:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<j6/nXg1D9p8vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 09:33:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<9mt3YQ1DSKxCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 09:35:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Ww4EaQ1D8qSPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.255
country_id: 1880251
description:
Nov  8 09:35:11 host2 sshd[220203]: Disconnected from invalid user localadmin 101.47.49.255 port 39766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 09:35:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<cIIxaA1DzICxiOOT>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.134.175.44
country_id: 1227603
description:
[2025-11-08 09:35:37 +0530] info [cpaneld] 112.134.175.44 - cloudtourssrilan "GET /cPanel_magic_revision_1758989017/frontend/jupiter/libraries/bootstrap/optimized/fonts/glyphicons-halflings-regular.woff HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [101.2.176.13] != Current IP Address [112.134.175.44]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 09:36:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<0psvbQ1DsrsBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 09:38:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<8rIFdA1DztiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 09:38:56 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<33PidA1Dxcsz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov  8 09:40:11 host2 dovecot[22732]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<bZJzeQ1DPCstT4DN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.193
country_id: 1880251
description:
Nov  8 09:40:21 host2 sshd[225979]: Disconnected from invalid user sharan 101.47.141.193 port 40002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 09:41:10 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9a/WfA1DyJUXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 09:43:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<MS89hQ1D3rsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 09:44:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<XgKQiA1DutKUcQ1r>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.193
country_id: 1880251
description:
Nov  8 09:45:37 host2 sshd[231985]: Disconnected from invalid user contact 101.47.141.193 port 46910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 09:46:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<MPVokA1DxoFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 09:46:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<hYgakQ1DpN5nVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.215.134.25
country_id: 3469034
description:
Nov  8 09:47:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=181.215.134.25, lip=66.85.158.91, session=<syC0lA1Dbq6114YZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 09:49:25 host2 sshd[236033]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 09:50:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<IS+gnw1DgKSYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov  8 09:52:41 host2 sshd[239778]: Disconnected from invalid user nodejs 45.249.245.22 port 59524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 09:52:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<pDKipg1D2tCOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 09:52:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<vJQFpw1D8OBD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 09:54:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<QdnbrA1D9Mel6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.224.230.123
country_id: 3932488
description:
Nov  8 09:53:51 host2 sshd[241046]: Disconnected from invalid user user1 38.224.230.123 port 48262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 09:53:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<UYabqg1DaNhn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 09:54:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<8bd5qw1DctiP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 09:55:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<QhWwrg1DjOtA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.229.250
country_id: 1880251
description:
Nov  8 09:55:40 host2 sshd[243591]: Disconnected from invalid user scsadmin 139.59.229.250 port 36418 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 09:56:19 host2 sshd[244298]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 09:56:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<X7busw1DIpUvT+mI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov  8 09:56:43 host2 sshd[244624]: Disconnected from invalid user leo 45.249.245.22 port 50834 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.224.230.123
country_id: 3932488
description:
Nov  8 09:56:30 host2 sshd[244500]: Disconnected from invalid user jupyter 38.224.230.123 port 50138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 09:57:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<eCgAtg1DlIKxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.229.250
country_id: 1880251
description:
Nov  8 09:57:11 host2 sshd[245209]: Disconnected from invalid user caja01 139.59.229.250 port 42928 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 09:57:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<2SBotw1DUqlnPeGp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.193
country_id: 1880251
description:
Nov  8 09:58:30 host2 sshd[246564]: Disconnected from invalid user astra 101.47.141.193 port 33976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 09:58:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<DJNJuw1DiJwv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov  8 09:57:58 host2 sshd[246001]: Disconnected from invalid user jose 45.249.245.22 port 45748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.224.230.123
country_id: 3932488
description:
Nov  8 09:59:11 host2 sshd[247259]: Disconnected from invalid user sunny 38.224.230.123 port 33606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.245.22
country_id: 1819730
description:
Nov  8 09:59:14 host2 sshd[247339]: Disconnected from invalid user upload 45.249.245.22 port 47444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 10:00:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<mlVSwQ1DyLBm1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Nov  8 10:01:37 host2 sshd[249918]: Disconnected from invalid user jboss 45.249.245.22 port 35594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.9
country_id: 2186224
description:
2025-11-08 10:02:08 dovecot_login authenticator failed for ([121.73.168.9]) [121.73.168.9]:57774: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-08 10:02:36 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:13673: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 10:05:44 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Q8y51A1DjInRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 10:07:00 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=</wor2Q1DnurRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 10:07:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<9D5G2w1D5zlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 10:07:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<JCl23A1DBrBFPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 10:08:02 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<tZb03A1DuGYv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 10:08:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<bDoK3g1DVLlK4fqm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.227.103.150
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.227.103.150 - bhelpitiya "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bhelpitiya (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.39
country_id: 6252001
description:
Nov  8 10:09:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ojKy4Q1DKNzN0h8n>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:10:46 host2 sshd[260664]: Disconnecting authenticating user root 86.43.118.152 port 50846: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:10:46 host2 sshd[260664]: error: maximum authentication attempts exceeded for root from 86.43.118.152 port 50846 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:11:33 host2 sshd[261367]: Disconnecting invalid user admin 86.43.118.152 port 51472: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 10:11:45 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<9m856g1DQOKc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 10:11:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Uk1e6g1DMrVnoNQc>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:10:55 host2 sshd[260775]: Disconnecting authenticating user root 86.43.118.152 port 50962: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:10:55 host2 sshd[260775]: error: maximum authentication attempts exceeded for root from 86.43.118.152 port 50962 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 10:11:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<mDow6Q1D9oUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 10:11:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XI7C5w1DNpsrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.43.118.152
country_id: 2963597
description:
Nov  8 10:11:22 host2 sshd[261226]: error: maximum authentication attempts exceeded for invalid user admin from 86.43.118.152 port 51314 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 10:13:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<qcYd8Q1DvMmzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 10:14:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<2fak8w1DYoUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 10:17:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<GEOj/g1D+Opm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.92.189
country_id: 3469034
description:
Nov  8 10:17:46 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=31.97.92.189, lip=66.85.158.91, session=<leS2/w1D4KYfYVy9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 10:17:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<cfjs/w1DJq2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 10:20:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<XKSbCA5DbM6P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 10:19:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<kB+uBw5DQucvT+mI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov  8 10:21:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<p//bCw5DOKotT4DN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 10:20:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<dRwUCw5DKIor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 10:22:44 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<QgJ+EQ5D0le2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.176
country_id: 2300660
description:
Nov  8 10:23:33 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.28.176, lip=66.85.158.91, TLS, session=<qPpdEw5D8tYpixyw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.23.191.87
country_id: 3469034
description:
Nov  8 10:23:11 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.23.191.87, lip=66.85.158.91, TLS, session=<FdgtEg5DoMCxF79X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 10:23:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<3b6NEw5DuKpnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 10:24:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<Lrh5GQ5DGoMBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 10:26:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<2F5iHg5Ddtii8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 10:25:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<RmHGHA5DDsorZDwA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 10:27:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MkXTIA5DhMFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 10:27:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<R0HEIQ5DYMml0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 10:28:11 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9wj5JA5D/pxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 10:28:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<G9yKJA5DloEzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 10:29:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<8LMwKg5DvuFK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 10:31:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<XJxJLw5DpJdnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 10:31:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PY5CMg5DDJ6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 10:32:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<Gw6yNQ5DeI5IPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 10:33:19 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<XQVVNw5DfKBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 10:34:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EvkIPQ5DNKePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 10:35:02 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<8z+APQ5D15Ez0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.72
country_id: 6252001
description:
Nov  8 10:35:20 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.72, lip=66.85.158.91, TLS, session=<DUyoPg5DbP+TuYRI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 10:35:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<MdlPQA5DaMyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 10:37:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<oNHKRQ5D8LFCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 10:38:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<6zZBSg5D1n4vWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov  8 10:40:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.99, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Yue5UA5D+9Ejy9Nj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov  8 10:41:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.99, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xLwZUw5D1OMjy9Nj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov  8 10:41:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.99, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<yu4XVg5DYOIjy9Nj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 10:42:57 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<fk/MWQ5D/r8vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 10:44:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<JM3nXQ5DvqND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 10:46:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vrJiZg5D3uMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 10:46:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<mc01Zw5D7KNnVK2y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov  8 10:47:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.99, lip=66.85.158.92, TLS, session=<KidKag5DNusjy9Nj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov  8 10:48:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.99, lip=66.85.158.92, TLS, session=<I8GcbQ5DEPAjy9Nj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 10:48:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<Sn3CbQ5DRrJIPGU3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 10:50:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<pCiZdA5DZq5D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 10:50:46 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<oTXEdQ5DyMiYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-08 10:51:28 dovecot_plain authenticator failed for (chign) [65.20.148.165]:41747: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 10:52:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<M+Fiew5DJqqP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.141.241
country_id: 3017382
description:
Nov  8 10:53:38 host2 sshd[307920]: Disconnected from invalid user wg 149.102.141.241 port 52942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.52
country_id: 3469034
description:
Nov  8 10:55:35 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.209.248.52, lip=66.85.158.91, TLS, session=<1Rz8hQ5Dp6y60fg0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-08 10:55:41 dovecot_plain authenticator failed for (garevertan) [65.20.250.63]:58247: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 10:55:45 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1Yaahw5DxLJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 10:56:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<HBikig5DZsKl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.102.141.241
country_id: 3017382
description:
Nov  8 10:56:41 host2 sshd[311546]: Disconnected from invalid user admin 149.102.141.241 port 33838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.81.154.194
country_id: 1269750
description:
Nov  8 10:55:56 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.81.154.194, lip=66.85.158.91, TLS, session=<hAk7hw5DC+FnUZrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 10:56:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<aQNzig5Dyuhn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 10:57:13 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<Fr/YjA5Drr6xiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.141.241
country_id: 3017382
description:
Nov  8 10:58:08 host2 sshd[313118]: Disconnected from invalid user sam 149.102.141.241 port 55502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 10:58:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<UHoIkA5DnsJm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 10:59:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<2GU/lg5Dpg0v7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov  8 11:00:48 host2 sshd[315988]: Disconnected from invalid user yuxiang 161.132.50.17 port 56878 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.206
country_id: 6252001
description:
Nov  8 11:01:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LPu/mg5Dnetb5qjO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.203
country_id: 6252001
description:
Nov  8 11:01:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.203, lip=66.85.158.92, TLS: Connection closed, session=<+aljmw5Dx4db5qjL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.207
country_id: 6252001
description:
Nov  8 11:01:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.207, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<//wrnA5Dpahb5qjP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.17
country_id: 3932488
description:
Nov  8 11:02:12 host2 sshd[317470]: Disconnected from invalid user allan 161.132.50.17 port 44944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 11:02:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<J099nw5DEuTRJpe/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov  8 11:03:33 host2 sshd[319392]: Disconnected from invalid user vpn 161.132.50.17 port 47128 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 11:04:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<3W1ypQ5DJsDRJvZG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.213
country_id: 6252001
description:
Nov  8 11:05:19 host2 dovecot[22732]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.213, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Z0TjqQ5DPsfG6xjV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 11:05:43 host2 sshd[321744]: Disconnected from invalid user yamilet 62.60.131.157 port 28150 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 11:06:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<DQpKrA5DDOQvT+mI>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-08 11:07:25 H=([87.120.36.32]) [87.120.36.32]:59858 F=<info@wikipedia.org> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 11:08:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<6hLCtA5Dxrsv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 11:08:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<XdgwtQ5DmoSc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 11:07:57 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kGQusw5DySFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 11:09:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<zIkCtw5DotIv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-08 11:10:35 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:50984: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 11:10:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<To5bvQ5DwrErmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-08 11:10:05 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:56596: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.160.197.231
country_id: 130758
description:
Nov  8 11:10:06 host2 sshd[326353]: Disconnected from invalid user yassine 5.160.197.231 port 54582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-11-08 11:10:23 dovecot_login authenticator failed for host-95-229-5-248.business.telecomitalia.it [95.229.5.248]:44734: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-08 11:10:26 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:43890: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 11:12:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<q7oBxA5DPLVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 11:13:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Ptl+yA5DyIIv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 11:14:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<3pj/yA5DPpxK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.160.197.231
country_id: 130758
description:
Nov  8 11:16:06 host2 sshd[333254]: Disconnected from invalid user traefik 5.160.197.231 port 55068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 11:16:25 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<VA560Q5DgKdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 11:16:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<3Obh0Q5D1oGzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 11:17:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Zhl91Q5DAtKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 11:17:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<hLGd1g5D5xq2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-11-08 11:18:47 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:37742: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 11:18:45 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<7y3Q2Q5D4oqP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-08 11:19:07 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:53606: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 11:20:11 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<vqL13g5D7ocr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 11:24:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<v8TV7A5DWNhnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.243
country_id: 1880251
description:
Nov  8 11:23:11 host2 sshd[340733]: Disconnected from invalid user user 101.47.163.243 port 45194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 11:24:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<lnoj7g5D5KwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 11:26:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<R3ij9A5D1IEzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 11:26:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<lPGz9Q5D/pVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 11:27:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ml8y+A5DBqFm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 11:27:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<vI0++Q5D2J6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.77.223
country_id: 1643084
description:
Nov  8 11:27:40 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=72.60.77.223, lip=66.85.158.91, session=<JSay+Q5D7rJIPE3f>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 11:28:34 host2 sshd[346974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 11:28:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<n0fx/A5DKKAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 11:28:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<3Ulu/g5DPq8vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 11:30:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<8lXiAg9DFMFnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 11:30:24 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<b4qDAw9DDoBnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.160.206
country_id: 1880251
description:
Nov  8 11:30:30 host2 sshd[349080]: Disconnected from invalid user oracle 101.47.160.206 port 60420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 11:30:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<cBo2BA9DIsaPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.229
country_id: 6252001
description:
Nov  8 11:31:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DbEgBg9DIMXN0h/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.243
country_id: 1880251
description:
Nov  8 11:31:16 host2 sshd[349838]: Disconnected from invalid user turtle 101.47.163.243 port 38588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 11:31:25 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<kuEkBw9DH8Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 11:31:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<9I/xBw9Djqql0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.160.206
country_id: 1880251
description:
Nov  8 11:32:54 host2 sshd[352170]: Disconnected from invalid user ubuntu 101.47.160.206 port 59440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 11:33:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<4xwNDw9DDkEvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 11:35:44 host2 sshd[355168]: Disconnected from invalid user yamilet 62.60.131.157 port 18069 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 11:35:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<LSAHFw9DSouxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.175
country_id: 6252001
description:
Nov  8 11:37:08 host2 sshd[356813]: Invalid user cloudtourssrilan_travel from 124.198.132.175 port 55460


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 11:37:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<B1HfHA9DBpNIPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 11:39:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<aARDIw9DYLlK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 11:40:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<CycKJw9D3tlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 11:41:56 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<mJS7LA9DyolD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 11:46:13 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<osYKPA9DbJ5nVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 11:48:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<UiuFQw9DrK9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 11:50:58 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<mxoTTQ9DBIyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 11:50:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<hHy0Sw9DQI8XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 11:50:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<l7oQTA9D5O2YIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.162
country_id: 6252001
description:
Nov  8 11:51:33 host2 dovecot[22732]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UQRETw9DLcPN0h+i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 11:51:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<00xBTw9DEKpIPGU3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 11:52:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<v9AhUQ9D0qAvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 11:55:15 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<gVdhXA9DvJZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 11:55:44 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<zTAPXg9DJuDRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 11:57:25 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OTQWZA9DmO2xiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 11:58:13 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<CIPzZg9Dosul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 11:59:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<9v5Rag9DKsfRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 11:58:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<drw5aQ9D8opn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 12:00:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<OkejbQ9DwJiOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 12:00:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<OR0ycA9Dhngv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 12:01:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<7hLBcg9DKusBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 12:02:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<3ePRdg9DAIMv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-08 12:02:45 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:45894: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.8
country_id: 1733045
description:
2025-11-08 12:03:12 dovecot_login authenticator failed for ([49.124.151.8]) [49.124.151.8]:47968: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  8 12:04:00 host2 dovecot[22732]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, session=<9IfIew9DbN5ChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 12:04:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<xtAXfg9DnLWc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 12:08:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wkECig9DCyNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 12:10:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<IHBxkQ9DKr8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 12:09:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<w7EJkQ9D4K9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 12:10:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<UcgtkQ9DUkEv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.79
country_id: 1880251
description:
Nov  8 12:11:15 host2 sshd[395622]: Disconnected from invalid user ahmad 101.47.161.79 port 57248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 12:11:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<pPfVlg9DvIIv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 12:11:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<y1aFlw9DbDy2uHYF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.84
country_id: 6252001
description:
Nov  8 12:14:05 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.84, lip=66.85.158.92, session=<rDnQnw9DsPqTuYRU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 12:15:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<cvJjpA9D4LmzALHl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-08 12:14:31 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:50592: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 12:15:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<epYJow9Dmpyi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 12:16:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<XA7Mpw9Drt5m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.46
country_id: 1880251
description:
Nov  8 12:16:58 host2 sshd[401784]: Disconnected from invalid user db2inst1 45.78.222.46 port 37580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 12:17:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=</Dz/qg9DnM+P9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.189
country_id: 1880251
description:
Nov  8 12:17:45 host2 sshd[402618]: Disconnected from invalid user jamshid 45.78.217.189 port 44056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.79
country_id: 1880251
description:
Nov  8 12:18:19 host2 sshd[403083]: Disconnected from invalid user lsj 101.47.161.79 port 34094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 12:17:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4llcrA9DSPaYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.136
country_id: 1880251
description:
Nov  8 12:18:14 host2 sshd[403120]: Disconnected from invalid user osvaldo 101.47.161.136 port 38858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 12:19:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<XL6HtA9DWqRK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 12:19:56 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<KKOktA9DPoor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.239.84.203
country_id: 3865483
description:
Nov  8 12:20:33 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=45.239.84.203, lip=66.85.158.91, TLS, session=<T//GtQ9DlJkt71TL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 12:20:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<cPTvtw9Djo5noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.225
country_id: 3469034
description:
Nov  8 12:20:53 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=170.82.52.225, lip=66.85.158.91, TLS, session=<bq8Rtw9DU7eqUjTh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 12:22:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<nsmLvA9Dxt0rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 12:22:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<C78Fvw9D8oNK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 12:23:46 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Q8dfwg9D4LuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 12:24:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Kv9yww9DJIIzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.79
country_id: 1880251
description:
Nov  8 12:23:30 host2 sshd[408770]: Disconnected from invalid user nam 101.47.161.79 port 48906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.46
country_id: 1880251
description:
Nov  8 12:24:49 host2 sshd[410054]: Disconnected from invalid user traccar 45.78.222.46 port 60890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 12:26:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qnV1zQ9DNsmPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-11-08 12:26:58 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:63409: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 12:27:06 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<U+1Kzg9DGYUz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 12:27:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Ve37zg9DnKlm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.46
country_id: 1880251
description:
Nov  8 12:27:26 host2 sshd[412901]: Disconnected from invalid user sim 45.78.222.46 port 59230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 12:28:10 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<qbwV0g9DC/ovWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov  8 12:27:31 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lDfgzw9DyKS58uIh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 12:29:26 host2 sshd[415085]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 12:29:12 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<ZBTC1Q9DBrtnJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.79
country_id: 1880251
description:
Nov  8 12:28:46 host2 sshd[414362]: Disconnected from invalid user traccar 101.47.161.79 port 46500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 12:29:10 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54737: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov  8 12:30:39 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UdUY2w9DnOK58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 12:32:22 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<engg4Q9DZNIvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 12:32:44 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<RlBt4g9DQqFnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.23
country_id: 3017382
description:
Nov  8 12:34:10 host2 dovecot[22732]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=91.196.152.23, lip=66.85.158.91, session=<6Uai5w9DsYZbxJgX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.110
country_id: 3017382
description:
Nov  8 12:34:21 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.110, lip=66.85.158.91, session=<ZNtW6A9Df7FbxJhu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.16
country_id: 3017382
description:
Nov  8 12:34:38 host2 dovecot[22732]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.16, lip=66.85.158.91, session=<XYFc6Q9DcbdbxJgQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.18
country_id: 3017382
description:
Nov  8 12:34:42 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.18, lip=66.85.158.91, session=<UZ6O6Q9DA6RbxJgS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.227.103.150
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.227.103.150 - info "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 12:35:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<6JqY7A9Dftil0xnK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.136
country_id: 1880251
description:
Nov  8 12:37:16 host2 sshd[423511]: Disconnected from invalid user yf 101.47.161.136 port 54090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 12:36:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<t7gg8A9DCKuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 12:37:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<vvZD8w9D/II+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 12:40:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<D+gd/Q9DFMpD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 12:40:07 host2 sshd[427180]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 12:43:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<qHabCBBDaNpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 12:45:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<Pt3hDhBDqJtK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 12:45:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<bhLTEBBDYKNnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.46
country_id: 1880251
description:
Nov  8 12:45:26 host2 sshd[433423]: Disconnected from invalid user test 45.78.222.46 port 53648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 12:46:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lx1pFBBDeKpD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 12:47:29 host2 sshd[435439]: Disconnected from invalid user darrius 62.60.131.157 port 65386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 12:49:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<AW7VHRBDKpXRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 12:49:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<9uAAHxBDKOaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 12:50:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<PwAuIRBDTrIBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 12:51:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<p0fAIxBDlDqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 12:51:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<lvLcIxBDsuZm1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.189
country_id: 1880251
description:
Nov  8 12:52:23 host2 sshd[441141]: Disconnected from invalid user cs2server 45.78.217.189 port 36814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 12:52:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qDR4KhBDioBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 12:55:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<IHHJNBBDptkXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.19.183
country_id: 2300660
description:
Nov  8 12:56:28 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=41.139.19.183, lip=66.85.158.91, TLS, session=<Dr4QNhBDA7ApixO3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.223
country_id: 3469034
description:
Nov  8 12:56:49 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.255.206.223, lip=66.85.158.91, TLS, session=<i/yUNxBDoOCK/87f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 12:57:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<nrpnOxBDarQv+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.189
country_id: 1880251
description:
Nov  8 12:57:46 host2 sshd[447969]: Disconnected from invalid user redhat 45.78.217.189 port 43606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 12:58:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OhgvPxBDkJCxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 12:59:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sqMSQxBDdLul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 13:00:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<YQZeRxBDXJtn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 13:02:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<CKEyTBBD1OMv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-08 13:05:57 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:37266: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-08 13:06:26 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:57332: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 13:08:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<tyy9YBBDzGG2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 13:08:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yUvtYBBDfUJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 13:10:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<+n9naRBD3otnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 13:09:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<RvSlZhBDjLUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 13:10:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<vRh8aBBDlKYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 13:11:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<9UFfbRBDlqwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.232.191
country_id: 3175395
description:
Nov  8 13:13:15 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=171.22.232.191, lip=66.85.158.91, TLS, session=<8QpychBDxrqrFui/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.51.241.213
country_id: 3175395
description:
Nov  8 13:13:33 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=93.51.241.213, lip=66.85.158.91, TLS, session=<vpyLcxBD/dtdM/HV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 13:15:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<C4irfBBDstKP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 13:16:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<PjZRfRBD2LyzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 13:16:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<7Q/lfhBDeIpm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 13:17:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Q15QgxBDeoIzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 13:18:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<IUklhRBDhkOYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.71
country_id: 99237
description:
2025-11-08 13:18:36 dovecot_plain authenticator failed for (unpark) [65.20.251.71]:59917: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 13:18:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<1Xl2hhBDf6Ez0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 13:19:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<ZPS9iRBDgLlK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 13:20:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<p1ObjBBDauMrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 13:20:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<HybZjBBDHsor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 13:20:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ny/RjRBDSJWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 13:22:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<DnK7khBD4rFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 13:22:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<iISmlRBDQbkvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 13:23:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<jarNmBBDHp2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 13:26:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<NofvoBBDcOZK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov  8 13:26:43 host2 sshd[480523]: Disconnected from invalid user sadmin 41.33.91.226 port 43152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 13:26:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<tjNbpBBDVLJm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov  8 13:27:14 host2 sshd[481168]: Disconnected from invalid user speedtest 45.172.152.74 port 39236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Nov  8 13:27:43 host2 sshd[481611]: Disconnected from invalid user ipfs 202.184.134.84 port 60896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov  8 13:28:05 host2 sshd[482072]: Disconnected from invalid user ubuntu 41.33.91.226 port 56910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 13:28:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<4JFWqhBDapxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.92.189
country_id: 3469034
description:
Nov  8 13:28:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=31.97.92.189, lip=66.85.158.91, session=<4QwVqhBD9tcfYVy9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov  8 13:30:22 host2 sshd[484372]: Disconnected from invalid user leonardo 185.116.160.35 port 33296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:30:28 host2 sshd[484471]: Disconnected from invalid user andrew 185.193.240.246 port 56186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.65
country_id: 1643084
description:
Nov  8 13:30:33 host2 sshd[484545]: Disconnected from invalid user ubuntu 103.193.178.65 port 55764 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Nov  8 13:31:06 host2 sshd[485191]: Disconnected from invalid user ipfs 45.172.152.74 port 52994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov  8 13:31:46 host2 sshd[485797]: Disconnected from invalid user sysadmin 41.33.91.226 port 35786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-08 13:31:49 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:34415: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-11-08 13:32:04 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:39644: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:31:39 host2 sshd[485651]: Disconnected from invalid user ipfs 185.193.240.246 port 56734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.141
country_id: 2635167
description:
Nov  8 13:33:11 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.141, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<goS7uhBDN+5X7LCN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.112
country_id: 2635167
description:
Nov  8 13:32:37 host2 dovecot[425774]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.112, lip=66.85.158.92, TLS, session=<9/u1uBBDXZdX7LBw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.111
country_id: 2635167
description:
Nov  8 13:32:38 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.111, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WqG/uBBDxaRX7LBv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.132
country_id: 2635167
description:
Nov  8 13:34:30 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KM5ovxBDJ9xX7LCE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.65
country_id: 1643084
description:
Nov  8 13:33:49 host2 sshd[487924]: Disconnected from invalid user bench 103.193.178.65 port 32822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.91.226
country_id: 357994
description:
Nov  8 13:34:14 host2 sshd[488368]: Disconnected from invalid user admin 41.33.91.226 port 47628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:34:03 host2 sshd[488179]: Disconnected from invalid user test1 185.193.240.246 port 57850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.125
country_id: 2635167
description:
Nov  8 13:35:03 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.125, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<EH1kwRBDReO594l9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 13:35:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<niijwhBDdNpnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 13:34:48 host2 sshd[488898]: Disconnected from invalid user ubuntu 45.78.202.217 port 49366 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.139
country_id: 2635167
description:
Nov  8 13:36:09 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.139, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RNNYxRBDRcJX7LCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.134
country_id: 2635167
description:
Nov  8 13:35:36 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vmhfwxBDketX7LCG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Nov  8 13:37:20 host2 sshd[492167]: Disconnected from invalid user amir 202.184.134.84 port 60954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 13:36:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<JfDYxhBDZIEvT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov  8 13:36:43 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XiFWxxBDYcFX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov  8 13:36:47 host2 sshd[491479]: Disconnected from invalid user test001 185.116.160.35 port 37306 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.111
country_id: 2635167
description:
Nov  8 13:37:16 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.111, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<tGJRyRBDu8xX7LBv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:37:32 host2 sshd[492372]: Disconnected from invalid user office 185.193.240.246 port 59548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.145
country_id: 2635167
description:
Nov  8 13:37:49 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.145, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yu1KyxBD19m594mR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 13:37:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<Rb6OyxBDOImxiOOT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov  8 13:38:22 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<xDZGzRBDq71X7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:37:31 host2 sshd[492354]: Disconnected from invalid user dev 187.45.100.0 port 35639 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 13:38:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<7BuXzhBD/r5D2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Nov  8 13:38:50 host2 sshd[493662]: Disconnected from invalid user hsadmin 202.184.134.84 port 59646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 13:38:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<OZFKzxBD1ucBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.235
country_id: 3175395
description:
Nov  8 13:40:25 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.70.204.235, lip=66.85.158.91, TLS, session=<D3mg0xBD/tBtRszr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 13:41:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<JX1b1xBD8qql0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:40:39 host2 sshd[495704]: Disconnected from invalid user demo 187.45.100.0 port 59179 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.208.106
country_id: 3175395
description:
Nov  8 13:40:43 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=94.198.208.106, lip=66.85.158.91, TLS, session=<52us1BBD+7hextBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.177
country_id: 6252001
description:
Nov  8 13:40:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.117.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8ySA1hBDUpusynWx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 13:45:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<65Ou5RBDLrhD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 13:45:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<2JXT5RBDVubRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 13:45:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<vGnf5hBDOrtnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:46:37 host2 sshd[502677]: Disconnected from invalid user es 187.45.100.0 port 44500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 13:46:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<RJmL6xBDrItCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 13:47:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<G4hI7BBDHMhIPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 13:47:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<dn2B7hBDaopm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 13:48:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<fXF28BBDJMWP9IUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:49:36 host2 sshd[505980]: Disconnected from invalid user aa 187.45.100.0 port 35440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 13:51:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<PZUr+xBDlpRK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 13:51:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Lxgx/BBD2MjRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 13:52:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<VmW1/xBDLl6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 13:54:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<baeHBhFDUN1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 13:55:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<gkjjCRFDZp4v+yzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.210.68.2
country_id: 6252001
description:
Nov  8 13:56:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.210.68.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2NRkDhFD8rqs0kQC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-08 13:59:24 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:38777: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 13:58:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<qKEuFRFDRsxIPGU3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-11-08 13:59:53 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:57322: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 13:59:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<gBRQGhFDooWxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 14:00:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<iUdBGxFDAtwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 14:01:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<K8K8HhFDNI+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 14:01:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<flkNIRFDfMc+PIOJ>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-08 14:02:57 H=([102.53.15.17]) [102.53.15.17]:46688 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <mail11@winpukpik777.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 14:03:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<eLlTJRFD2Ktn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 14:04:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<zoV5KRFD9KCi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 14:03:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<cSxiKBFDDlMv7AMK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 14:05:15 host2 sshd[524291]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 14:04:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<uByHKxFDPBy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 14:08:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<jn8iOBFDPLUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 14:08:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VCH1OBFDHxpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 14:08:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<9st2OhFDvOuOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 14:10:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<VGw4QBFDdL8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 14:12:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<zGLtRRFD7KlnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.108
country_id: 6252001
description:
Nov  8 14:12:21 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.108, lip=66.85.158.92, TLS, session=<OGXQRhFDLu2TuYRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.104
country_id: 3469034
description:
Nov  8 14:11:33 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.154.227.104, lip=66.85.158.91, TLS, session=<IFLaQhFDH7axmuNo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.119
country_id: 798544
description:
Nov  8 14:11:52 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.30.119, lip=66.85.158.91, TLS, session=<pSwBRBFDcZSy2B53>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 14:13:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<JyCBSRFDfBwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 14:13:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Iz7vShFDXMoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 14:14:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<D41aTRFDyIIzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 14:14:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<4/sPTxFDauuP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 14:14:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9crjTxFD9t9m1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 14:15:52 host2 sshd[537513]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 14:16:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<2d9GVBFD2t5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 14:16:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<3DPXVBFDxo9FPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 14:17:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<yoimWBFD/rqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 14:17:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<eIl2WRFD0XcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 14:18:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<N1jhWxFD1OcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 14:18:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<AwlwXRFDBI+zALHl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.103.212
country_id: 1605651
description:
Nov  8 14:18:57 host2 sshd[540767]: Disconnected from invalid user grid 147.50.103.212 port 54358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov  8 14:19:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.49, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ec+HXxFDd8JbxJgx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.254
country_id: 1880251
description:
Nov  8 14:19:19 host2 sshd[541283]: Disconnected from invalid user ftp-test 101.47.140.254 port 37370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov  8 14:19:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.77, lip=66.85.158.92, TLS: Connection closed, session=<UPw3YBFD/d9bxJhN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 14:20:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QRRwYxFDKmaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 14:20:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rBPBYxFDasCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 14:19:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<LAZZYBFDir8r4TT5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.54
country_id: 3017382
description:
Nov  8 14:19:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<++H6YBFDI5dbxJg2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.79
country_id: 3017382
description:
Nov  8 14:19:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.79, lip=66.85.158.92, TLS: Connection closed, session=<YhQrYRFDNddbxJhP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:20:30 host2 sshd[542635]: Disconnected from invalid user serv 45.78.202.217 port 45802 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.104.166
country_id: 6252001
description:
Nov  8 14:20:42 host2 pure-ftpd[542946]: (?@172.202.104.166) [INFO] New connection from 172.202.104.166


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.103.212
country_id: 1605651
description:
Nov  8 14:24:29 host2 sshd[547755]: Disconnected from invalid user ai 147.50.103.212 port 39534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 14:23:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<aKfibxFDVL1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 14:25:45 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<fh6UdhFDPr5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 14:27:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<iGIBfBFDfLEBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 14:28:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<4sXufhFDsN5nJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-08 14:30:53 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:43921: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:31:10 host2 sshd[555205]: Disconnected from invalid user martin 45.78.202.217 port 52086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-08 14:31:21 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:42278: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 14:32:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<c+ENjRFDlshK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 14:37:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<KJqPoBFDRMVD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 14:38:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fbiTohFDBqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 14:39:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<bxQ3qBFDwt2xiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 14:40:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<xf1cqxFDJtovT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 14:41:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<UekjrRFDiOjRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-08 14:42:05 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:38381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-08 14:42:15 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:42708: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.115.39
country_id: 2750405
description:
[2025-11-08 14:43:16 +0530] info [cpaneld] 196.251.115.39 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 14:44:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Ibz6txFDNKFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.46
country_id: 3175395
description:
Nov  8 14:45:30 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.15.170.46, lip=66.85.158.91, TLS, session=<7chJvBFDWp25D6ou>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:44:32 host2 sshd[570376]: Disconnected from invalid user park 198.46.249.175 port 50422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 14:44:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<PgJUuxFDOJxm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 14:45:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<16VJvBFDfLdnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-08 14:45:30 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:45947: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.38
country_id: 1269750
description:
Nov  8 14:45:51 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=202.136.85.38, lip=66.85.158.91, TLS, session=<OmN3vRFDva3KiFUm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-08 14:46:00 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:60867: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:46:20 host2 sshd[572884]: Disconnected from invalid user temp 154.91.170.39 port 54480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 14:47:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<TnOawhFDIKCl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 14:47:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<zJIMwxFDLNuP9IUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:47:09 host2 sshd[573828]: Disconnected from invalid user ark 45.78.202.217 port 50026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-08 14:47:55 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35008: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-08 14:48:04 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:51542: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:48:36 host2 sshd[575364]: Disconnected from invalid user user1 198.46.249.175 port 36308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 14:49:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=</g/uzBFDyMfRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:49:54 host2 sshd[576664]: Disconnected from invalid user alvaro 154.91.170.39 port 54888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.112
country_id: 1643084
description:
Nov  8 14:51:05 host2 sshd[578099]: Disconnected from invalid user jhlee 103.191.14.112 port 59240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 14:51:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<p3600RFDNIFCYSpH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:52:13 host2 sshd[579349]: Disconnected from invalid user pg 154.91.170.39 port 55154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 14:53:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<hNE52BFDXrEv+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:53:18 host2 sshd[580566]: Disconnected from invalid user marco 154.91.170.39 port 55288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:53:26 host2 sshd[580725]: Disconnected from invalid user me 198.46.249.175 port 48344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 14:54:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gKwL3hFDNIGYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.254
country_id: 1880251
description:
Nov  8 14:54:48 host2 sshd[582433]: Disconnected from invalid user sonar 101.47.140.254 port 37396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:56:08 host2 sshd[583972]: Disconnected from invalid user infinity 198.46.249.175 port 59034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 14:56:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<FJU05hFDTqhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 14:57:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8tzV5xFDrIVK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov  8 14:56:45 host2 sshd[584564]: Disconnected from invalid user admin 103.174.115.196 port 57842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov  8 15:00:24 host2 sshd[588772]: Disconnected from invalid user infinity 103.174.115.196 port 53850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 15:02:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<hUlF+hFDsL6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 15:03:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<SnQV/BFDl5m2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 15:02:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<1/cg+hFDTOqxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 15:04:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<WlysAhJDdMIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 15:05:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<NoA+BRJDPMIv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 15:05:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<1Gs0BhJDZLxn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 15:07:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<soSVDRJDbsQv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 15:10:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<EBn/FBJDgYkz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 15:10:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kIYiFRJDoTtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 15:11:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ZDd2GRJD+t0rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 15:10:40 host2 sshd[602241]: Disconnected from invalid user sheridan 62.60.131.157 port 12538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 15:12:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<MsCQHRJDHIMzTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-08 15:12:29 dovecot_plain authenticator failed for (sison) [102.53.15.180]:50773: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 15:13:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<0VOJIBJDEs5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 15:14:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xLkiIxJDsrCP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 15:14:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<CcHsJBJDpLxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 15:14:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kkn5JBJDGJ1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 15:14:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<huc+JhJDwLGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 15:15:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<e9TsJhJDSowv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 15:15:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<V67zKBJDCukBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 15:16:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<8ukuLRJDXN0rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 15:18:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<vyyMMRJDdOiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 15:19:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<5LsnNRJDbpgr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.45
country_id: 3175395
description:
Nov  8 15:19:09 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.208.188.45, lip=66.85.158.91, TLS, session=<MsuwNBJDKsu50Lwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.131
country_id: 953987
description:
Nov  8 15:19:31 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.43.131, lip=66.85.158.91, TLS, session=<rXnUNRJDT9JmQCuD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:19:41 host2 sshd[613577]: Disconnected from invalid user william 196.204.240.61 port 36300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 15:22:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<jWe/QBJDgNKzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 15:22:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<M5JrQRJDRoqYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:23:51 host2 sshd[618026]: Disconnected from invalid user dev 196.204.240.61 port 49330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 15:25:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<zeXKSxJDvoJm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  8 15:25:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<wfEXTRJD9rtChJl7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 15:26:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QLIoTxJDIKVnoNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:26:40 host2 sshd[622086]: Disconnected from invalid user new 196.204.240.61 port 32812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 15:27:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<g8rgUhJDTLQ+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:28:09 host2 sshd[624223]: Disconnected from invalid user wangrui 196.204.240.61 port 52532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 15:29:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<D3UfWRJDYsNnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-08 15:30:41 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:44282: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-08 15:31:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:33330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 15:37:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<njykdRJD1OhD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 15:37:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<GOZadhJDEs3RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 15:38:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<IKXUehJDHuNK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 15:40:55 host2 sshd[638778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 15:41:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<uzv1hRJDCI1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 15:42:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<NqNNiBJDJK5m1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 15:42:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<t8ruiRJDEsaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 15:43:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<wfdfjRJDvI1D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 15:45:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<yiq/khJDULwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 15:46:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<S+nVlRJDlLBnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 15:46:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<6l2tmBJDiImP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov  8 15:49:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nP5AoRJDBr5ChJlw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 15:49:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<15W4oRJDrLrRJvZG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 15:51:31 host2 sshd[650398]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 15:51:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<j9N3qBJDzt0v+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 15:52:23 host2 sshd[651327]: Disconnected from invalid user barry 62.60.131.157 port 57364 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.163.156.184
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 194.163.156.184: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 15:54:59 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<spy1tRJDBsOl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 15:55:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<LTHruBJDbKei8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 15:56:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<CuTBuRJDetBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 15:56:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<n8xKvBJD4qaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 15:59:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Da0BxRJDGI1A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 15:59:32 host2 sshd[659874]: Disconnected from invalid user pig 43.252.229.25 port 51694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 16:02:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<PkP+zxJDyOu2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:02:30 host2 sshd[663324]: Disconnected from invalid user db 43.252.229.25 port 57986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:04:08 host2 sshd[665627]: Disconnected from invalid user services 175.100.24.139 port 53208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 16:04:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<kLqg1hJDuoBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 16:04:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<HY281hJDXLIBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 16:05:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<uTBi2hJDLNmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 16:05:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GSHh2hJDsIil6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:05:24 host2 sshd[667363]: Disconnected from invalid user staff 43.252.229.25 port 36042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:05:36 host2 sshd[667442]: Disconnected from invalid user v 170.9.0.121 port 39424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:07:00 host2 sshd[669042]: Disconnected from invalid user user1 43.252.229.25 port 39220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 16:06:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<P40O4BJD/7kz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-08 16:07:47 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:37946: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 16:07:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<HJst5BJDkjcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 16:08:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<HZgN5hJDHPIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:08:33 host2 sshd[670697]: Disconnected from invalid user elena 43.252.229.25 port 42394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 16:09:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<a2Bi6BJDhqsv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-08 16:08:26 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:33445: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:09:54 host2 sshd[672165]: Disconnected from invalid user guest 202.137.142.115 port 36640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 16:10:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<kE5m6xJD2Mxn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 16:11:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<4eos7xJDltVK0NqG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 16:10:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54375: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 16:10:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Shvm7RJDZoMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 16:10:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<isZT7hJDzxFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:10:18 host2 sshd[672770]: Disconnected from invalid user roman 45.78.198.78 port 54480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 16:10:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kM+A7hJDptAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 16:13:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Ma5h9hJDXOyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 16:12:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<r65i8xJDFpcrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:12:31 host2 sshd[675223]: Disconnected from invalid user guest 175.100.24.139 port 33860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-08 16:12:44 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:40228: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-08 16:13:20 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:38080: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 16:13:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<I1Pf+BJD8t+P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 16:14:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ysTS+RJD9t1m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:14:03 host2 sshd[676809]: Disconnected from invalid user devops 170.9.0.121 port 41040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 16:14:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<A0X0+xJDRqaOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 16:15:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<Kfmv/hJDuLgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.74
country_id: 3469034
description:
Nov  8 16:15:28 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.216.88.74, lip=66.85.158.91, TLS, session=<7AXw/RJDg8m62FhK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.10
country_id: 798544
description:
Nov  8 16:15:45 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.105.10, lip=66.85.158.91, TLS, session=<LJcn/xJD1OVb9mkK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:15:47 host2 sshd[678770]: Disconnected from invalid user zeppelin 45.78.198.78 port 45086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 16:16:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<A+G2ARNDjNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 16:17:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<SL7vBRNDFP4v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 16:18:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<OASTChNDvuwr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 16:18:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<hDj+CRNDWupnoNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Nov  8 16:20:34 host2 sshd[684528]: Disconnected from invalid user ngdc 34.85.163.94 port 46022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:20:53 host2 sshd[684911]: Disconnected from invalid user alvin 175.100.24.139 port 53106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:20:24 host2 sshd[684355]: Disconnected from invalid user vera 202.137.142.115 port 59936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:22:09 host2 sshd[686542]: Disconnected from invalid user guest 202.137.142.115 port 35606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 16:21:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<KF6DExNDCJNFPkwt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 16:22:14 host2 sshd[686622]: Disconnected from invalid user barry 62.60.131.157 port 10297 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:22:19 host2 sshd[686749]: Disconnected from invalid user guest 170.9.0.121 port 57048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  8 16:23:39 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xV1hHBND08pX7LDX>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.78
country_id: 2635167
description:
Nov  8 16:23:38 host2 dovecot[425774]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS, session=<aVVNHBNDT7W594lO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:24:35 host2 sshd[689179]: Disconnected from invalid user tiptop 89.39.246.58 port 39248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.204
country_id: 2635167
description:
Nov  8 16:24:46 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.204, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<XhRYIBNDK6u594nM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 16:24:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<JIV6IBNDCLWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 16:25:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<xhI8IRNDboJm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.184
country_id: 2635167
description:
Nov  8 16:24:13 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.184, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EbRcHhNDPe2594m4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  8 16:25:19 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<WJdTIhND64dX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.206
country_id: 2635167
description:
Nov  8 16:25:52 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.206, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<O9JOJBNDX+tX7LDO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Nov  8 16:26:25 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Hi5IJhNDT81X7LC4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 16:26:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<dx0CKBNDLOyzALHl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.211
country_id: 2635167
description:
Nov  8 16:26:59 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.211, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<il9FKBNDw8G594nT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 16:27:37 host2 sshd[692359]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:27:16 host2 sshd[692178]: Disconnected from invalid user homeassistant 146.190.111.235 port 35586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov  8 16:27:32 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<YcdAKhNDgcxX7LDC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:27:57 host2 sshd[692804]: Disconnected from invalid user worker 175.100.24.139 port 40280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.201
country_id: 2635167
description:
Nov  8 16:28:05 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<rSI6LBNDT5e594nJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:28:09 host2 sshd[693067]: Disconnected from invalid user kamil 89.39.246.58 port 56922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.120.227
country_id: 6252001
description:
Nov  8 16:28:32 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.120.227, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CrXYLRNDPLIUqHjj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.196
country_id: 2635167
description:
Nov  8 16:28:39 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<G/ZELhNDVYK594nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 16:29:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<pN5dMRND/MBnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 16:30:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<s5CpNBNDpulnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:32:54 host2 sshd[697877]: Disconnected from invalid user smb 89.39.246.58 port 45536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:32:32 host2 sshd[697498]: Disconnected from invalid user omm 154.92.109.196 port 62124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 16:33:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<PPriPxNDHqDRJpe/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.227.110
country_id: 6252001
description:
Nov  8 16:33:44 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.206.227.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9sxyQBNDGuWszuNu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:34:15 host2 sshd[699336]: Disconnected from invalid user postmaster 146.190.111.235 port 33184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:34:18 host2 sshd[699351]: Disconnected from invalid user gerard 154.92.109.196 port 57070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:35:45 host2 sshd[700937]: Disconnected from invalid user cod4server 146.190.111.235 port 59772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.43
country_id: 298795
description:
Nov  8 16:37:02 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=95.0.171.43, lip=66.85.158.91, TLS, session=<LlcxSxNDE6pfAKsr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:37:10 host2 sshd[702466]: Disconnected from invalid user opc 146.190.111.235 port 50296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 16:37:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<wQumTBND8MRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.124
country_id: 798544
description:
Nov  8 16:37:20 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.20.58.124, lip=66.85.158.91, TLS, session=<Zb1LTBNDzIMuFDp8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:38:39 host2 sshd[704063]: Disconnected from invalid user wf 146.190.111.235 port 33948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:39:55 host2 sshd[705312]: Disconnected from invalid user rafael 45.78.198.78 port 60378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 16:40:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<x6CpWBNDLsBm1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:42:36 host2 sshd[708312]: Disconnected from invalid user abbas 45.78.198.78 port 34434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:43:24 host2 sshd[709189]: Disconnected from invalid user chatbot 103.250.10.101 port 57546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 16:43:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<EKr5YxND6oBD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:44:52 host2 sshd[711183]: Disconnected from invalid user isaac 103.250.10.101 port 56264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 16:45:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<Qn3faBNDaOyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.48.162
country_id: 798544
description:
Nov  8 16:44:27 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=31.134.48.162, lip=66.85.158.91, TLS, session=<JtPGZRNDZdUfhjCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.208
country_id: 798544
description:
Nov  8 16:44:45 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.208, lip=66.85.158.91, TLS, session=<Q6zTZhNDDOcu4yfQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:44:49 host2 sshd[711137]: Disconnected from invalid user user40 154.92.109.196 port 25993 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 16:45:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8nmBaxNDZq9K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 16:46:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Sk6jbBNDSI1nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:46:17 host2 sshd[712805]: Disconnected from invalid user matin 103.250.10.101 port 60412 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 16:46:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<qw1MbRND+rxnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 16:46:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<beKibhNDkNCP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 16:49:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<DPQXeBNDmITRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 16:49:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<8WJfeRNDzKYv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.186
country_id: 2328926
description:
2025-11-08 16:51:34 dovecot_login authenticator failed for (lezzarotech.com) [197.211.52.186]:47657: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 16:52:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<RXSGgxNDUJYBFNmn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 16:54:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wxE6ihNDuIY+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-11-08 16:54:25 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:34996: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 16:54:52 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:60887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 16:58:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<J+/1mRNDZNyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:00:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<BX2voBNDjSC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 17:01:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<3UmmohNDoq1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 17:01:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<OViFpBNDMKxCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 17:03:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<72aHqhND9uwz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 17:03:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<05qkqhNDHo+l0xnK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.255.208.83
country_id: 1814991
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 116.255.208.83 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 17:04:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zgoKrhND+K0vWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov  8 17:06:04 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<BVcNtBND9f7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.39
country_id: 1880251
description:
Nov  8 17:06:57 host2 sshd[736491]: Disconnected from invalid user runner 45.78.222.39 port 38484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.116
country_id: 2464461
description:
2025-11-08 17:07:02 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.116]:36832: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-08 17:06:28 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:53980: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:06:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<vt7fthND7KmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 17:07:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<gGWPuBNDBIGl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:07:14 host2 sshd[736909]: Disconnected from invalid user jahan 50.84.211.204 port 60774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 17:08:45 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<w/2IvRNDYs9K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 17:08:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<m+uavRNDooMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 17:09:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Pv4WvxNDGt4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Fbm7xhNDDqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<AHayxhNDQjJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:11:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<vPNVxxNDzJVK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.175.30.243
country_id: 6252001
description:
2025-11-08 17:12:33 dovecot_plain authenticator failed for c-73-175-30-243.hsd1.pa.comcast.net ([89.116.164.85]) [73.175.30.243]:53920: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.22.125.38
country_id: 6252001
description:
2025-11-08 17:12:44 dovecot_plain authenticator failed for 174-22-125-38.dvnp.qwest.net ([89.116.164.85]) [174.22.125.38]:40675: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.202.4.186
country_id: 3625428
description:
2025-11-08 17:12:55 dovecot_plain authenticator failed for ([89.116.164.85]) [190.202.4.186]:13829: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 17:13:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<JWS9zBND7r4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:13:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<WIPYzhNDzNmP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 17:13:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<aTpzzxND+pMrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 17:13:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<l6ozzhNDSt1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:14:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1MMr0hND8K6PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:14:32 host2 sshd[745499]: Disconnected from invalid user david 50.84.211.204 port 37362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:15:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<3D6u1BND4r5m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:15:46 host2 sshd[746949]: Disconnected from invalid user prueba 50.84.211.204 port 38158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-08 17:16:28 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:43744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:16:41 host2 sshd[748000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-08 17:16:50 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:59401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 17:17:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Fyev2xNDoNcr4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 17:18:49 host2 sshd[750270]: Disconnected from invalid user user 2.57.121.25 port 37743 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:21:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<jz106hNDfMdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-08 17:23:03 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:54960: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-08 17:23:19 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:59524: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:24:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Ww7S9BNDfMcv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:25:57 host2 sshd[758658]: Disconnected from invalid user test 162.240.156.34 port 54556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:26:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<LXAl/BND+Ndm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 17:26:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4/sg/BNDJOeYIMkL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:27:20 host2 sshd[760473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:28:18 host2 sshd[761624]: Disconnected from invalid user ll 162.240.156.34 port 39536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-08 17:28:45 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:56210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 17:29:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lWJkBhRDJoxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 17:29:39 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Pn5GCBRDJsTRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.106.224.231
country_id: 783754
description:
2025-11-08 17:30:41 dovecot_plain authenticator failed for ([89.116.164.85]) [79.106.224.231]:33614: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:30:49 host2 sshd[764477]: Disconnected from invalid user hesam 162.240.156.34 port 40428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.55.232.113
country_id: 3469034
description:
2025-11-08 17:30:55 dovecot_plain authenticator failed for ([89.116.164.85]) [189.55.232.113]:42284: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:33:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<moicFBRDjrJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:34:15 host2 sshd[768111]: Disconnected from invalid user bit 162.240.156.34 port 41712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-08 17:36:22 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:46812: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:36:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<GZAAIRRD5oFD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:36:39 host2 sshd[771107]: Disconnected from invalid user tesoreria 162.240.156.34 port 42596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:37:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nZc/IxRDwI0v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 17:37:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<+miiIxRDQNJm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 17:40:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<tw1fLxRD/oUBFNmn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-08 17:42:25 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:59748: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-08 17:42:47 dovecot_login authenticator failed for erpump.tcil.in [1.7.83.133]:41232: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-08 17:43:08 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:34042: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:43:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<yv1+OBRDDI9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 17:45:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<KbhtQhRDoNpnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:45:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5W18QhRDfJaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:46:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=</vfoQhRDOsGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 17:46:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Y2wYRhRDPp+i8JQo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  8 17:47:17 host2 pure-ftpd[783057]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 17:47:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<V32lSRRDotUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 17:48:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<TBr3ShRDNJrRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 17:50:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<PkUIUhRDRpxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:52:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<gSJHWRRDquBK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-11-08 17:52:38 dovecot_login authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:59652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-08 17:52:54 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:48153: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 17:54:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<USenYhRDYqgvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:58:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<WOifbRRDtBe2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.248
country_id: 3865483
description:
Nov  8 17:59:51 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.96.195.248, lip=66.85.158.91, TLS, session=<qQhCcxRDiay6YMP4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:00:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2J2LdRRDLi6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.30.227
country_id: 933860
description:
Nov  8 18:00:15 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=83.143.30.227, lip=66.85.158.91, TLS, session=<7BiYdBRDjp5Tjx7j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:00:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</u3ldRRD4qQz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:00:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<bpC7dxRDlFcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 18:03:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<AXa1fxRDnJ9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 18:05:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<3FXqiRRD0JpK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 18:06:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<ZiyXihRDEtlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 18:07:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<bpQNjhRD3IMzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 18:07:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sOcVkBRDiqil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:07:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OWpQkBRD+JOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:07:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lMRpkBRDMqWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 18:09:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xURclRRDot4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 18:10:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zxtsmRRDegRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:10:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EIsFmxRDmJOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 18:10:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<rm3bmxRDWsSl0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:14:11 host2 sshd[815648]: Disconnected from invalid user perry 62.60.131.157 port 41358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 18:13:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<B9qfphRDjtArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 18:15:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Tyn6qhRD4O1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:15:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SCAsrBRDsqdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 18:15:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<5ZE7rBRDPJIr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-08 18:15:37 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (caraele) [71.41.202.12]:35243: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:16:29 host2 sshd[818167]: Disconnected from invalid user admin 203.154.162.65 port 50234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8VDrsRRD/OVK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:17:43 host2 sshd[819617]: Disconnected from invalid user ian 203.154.162.65 port 49278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-08 18:17:53 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:53862: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-08 18:18:08 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:46444: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-08 18:18:25 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:48234: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 18:18:34 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:53207: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:20:13 host2 sshd[822427]: Disconnected from invalid user devops 203.154.162.65 port 47374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 18:20:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<E+I6vRRDGIiOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:23:53 host2 sshd[826279]: Disconnected from invalid user ts3 203.154.162.65 port 44526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:24:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ygLKyhRD2MlnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 18:25:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<oP040RRD4p3RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:26:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c99+0xRDANNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:27:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Srz01xRDDjmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 18:28:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Zo172RRDFspnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 18:28:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=</dMA2xRDVOcBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 18:34:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<3fqh7hRDMuRm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov  8 18:35:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<VikU9RRDBpKnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:35:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vVVn9RRDbJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:36:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<HKe39xRDPphD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:43:04 host2 sshd[848310]: Disconnected from invalid user perry 62.60.131.157 port 40105 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:43:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<+hFCDxVDXtlD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 18:43:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZPv6DxVDGIdnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-08 18:43:48 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:53192: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-08 18:44:23 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:51858: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 18:44:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jxiSExVDuuyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 18:46:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<fKt5HBVDXpcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:46:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<VB3MHBVDPoOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 18:47:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<ZCZZHRVDTJvRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 18:51:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5k5DLRVDojEv7AMK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 18:52:55 host2 sshd[860511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 18:54:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fJTwNxVDiq9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 18:55:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<GwmwOxVDSPq2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 18:56:16 host2 sshd[864700]: Disconnected from invalid user kevin 101.47.161.161 port 39740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:57:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<YJCKQRVDqJFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<3K8NQBVDp/ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<J7AXQBVDfckz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 18:59:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<RN+6ShVDNNIvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 18:59:57 host2 sshd[868564]: Disconnected from invalid user user 2.57.121.25 port 41572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-08 19:01:14 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:50210: 535 Incorrect authentication data (set_id=mail@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:02:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hprMUhVDRleYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:02:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Yj8IVBVDFNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:02:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<v2+uVBVDIrlK0NqG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:03:39 host2 sshd[873632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 19:04:26 host2 sshd[874572]: Disconnected from invalid user tidb 101.47.161.161 port 60836 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 19:04:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<LnA/XBVDzMFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 19:04:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<WIWgXBVDDIQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:05:27 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nFPmXhVDBpaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 19:06:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mqWMYhVDTqal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 19:06:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5DoYZBVDdgUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 19:07:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LkVPZhVDxSJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:09:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<dbnkaxVDCrOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 19:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<2j0BbBVDmNYv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 19:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Ctu1bBVDysdCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:10:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Zb5FcBVDKIqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 19:10:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<IShfcBVDZrcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 19:13:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<ARMXfRVDhLor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 19:14:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2NWzfxVDBN8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 19:16:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<OGd/hRVDANgBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 19:16:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=</V6UhxVDgrSl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:16:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<a1lThhVDLthm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 19:19:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<bdQWkRVD5I9n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 19:22:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<tGfymhVDjpZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 19:21:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Rj61mRVDTt7RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 19:22:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<Cc4NnBVD8LOOtOyP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:24:48 host2 pure-ftpd[897276]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 19:26:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<urBXqhVDzKRnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:27:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C44PrhVDBuhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:28:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<14CRsBVDHpFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:29:59 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4G+ZthVDYGKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 19:30:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<ZD1YuBVD4odm1PbI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:30:54 host2 pure-ftpd[903980]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:35:15 host2 sshd[908080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:35:08 host2 sshd[908411]: Disconnected from invalid user doris 27.254.235.2 port 35162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:36:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<qHgszxVDGuRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 19:37:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Hask0BVD4pai8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:40:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kkjc2xVDqo1noNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:41:05 host2 sshd[915119]: Disconnected from invalid user sina 27.254.235.2 port 54054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 19:42:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<RziT4RVDiOtnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:43:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lp/S5hVDlIND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:43:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ziIh6BVDpJ2P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 19:43:53 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:53270: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 19:44:02 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:64772: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-08 19:44:20 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:59415: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 19:44:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<bjwd6xVDIOLRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 19:46:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<rcjo7xVDgK4v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:48:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<o2I7+RVD9pyxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:51:00 host2 sshd[926026]: Disconnected from invalid user newuser 27.254.235.2 port 47358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 19:52:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<EdMTBxZD6ZIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 19:53:06 host2 sshd[928390]: Disconnected from invalid user alexys 62.60.131.157 port 35074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 19:53:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<fueMCRZDM4Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 19:54:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<8bjPDRZDbVu2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-11-08 19:56:04 dovecot_plain authenticator failed for (diese) [65.20.163.103]:47010: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:57:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3ebhFxZDmqyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 19:58:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ytS+HRZDMqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:00:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lDJVIhZDHOePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:59:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<EMKmHxZDtNVK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 19:59:26 host2 sshd[935113]: Disconnected from invalid user user 2.57.121.25 port 41715 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:00:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LbzuJBZDZsOi2JXJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:01:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gVzbJhZDouqi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:02:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<oWSfKRZDSoQzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  8 20:02:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DG+2KxZDqOdChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:03:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<XDnRLBZDauVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:04:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<bqFuMBZDtsoBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 20:04:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<XxGNMRZDap0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:04:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8JyrMhZD9ICYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 20:05:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61799: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 20:05:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oZbtNBZDqh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 20:06:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cxUDOhZDDI+l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:06:44 host2 sshd[943124]: Disconnected from invalid user julius 2.113.74.42 port 51290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 20:08:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<QECPPhZD6IkrZDwA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:08:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS, session=<hnFRPxZDjvSi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:09:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<wA62QhZDoraP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 20:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<26mMQhZDxtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 20:09:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Z15IRRZDoMlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:10:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<NmVHSBZDOMuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 20:11:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<h6ENSxZDWItCYSpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:11:37 host2 sshd[948429]: Disconnected from invalid user orca 168.167.228.74 port 35318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  8 20:12:29 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<Czq1ThZDLtkjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:13:19 host2 sshd[950183]: Disconnected from invalid user max 168.167.228.74 port 35319 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-08 20:14:28 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:33703: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:14:59 host2 sshd[951805]: Disconnected from invalid user init 122.166.49.42 port 50190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-08 20:15:01 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:58303: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 20:15:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Uo/CWBZDqqUr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 20:15:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<zhUPWxZDlNcrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:16:22 host2 sshd[953449]: Disconnected from invalid user webmaster 2.113.74.42 port 51254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:17:07 host2 sshd[954191]: Disconnected from invalid user netbox 45.78.216.103 port 47618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:17:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<NiSiXxZD/Ndm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:21:06 host2 sshd[958758]: Disconnected from invalid user rsyncuser 168.167.228.74 port 35324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:21:09 host2 sshd[958775]: Disconnected from invalid user test_user 2.113.74.42 port 46892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:21:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<q0yZbhZDCKAv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:22:23 host2 sshd[960082]: Disconnected from invalid user debian 45.78.216.103 port 40300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 20:22:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<sVC9cxZDir6l0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:23:49 host2 sshd[961498]: Disconnected from invalid user mohammed 103.59.94.124 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:24:48 host2 sshd[962389]: Disconnected from invalid user api_user 122.166.49.42 port 35578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 20:24:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<skB5eRZDVqBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 20:25:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<7yaifBZDZruOtOyP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:25:52 host2 sshd[964154]: Disconnected from invalid user sagar 168.167.228.74 port 35327 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 20:27:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<5gGGghZD7plm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:28:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<n522hhZDONRm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:28:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<Rv+QhxZDpJ5K4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:29:44 host2 sshd[968227]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.202
country_id: 6252001
description:
Nov  8 20:31:13 host2 pure-ftpd[970020]: (?@195.184.76.202) [INFO] New connection from 195.184.76.202


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.204
country_id: 6252001
description:
Nov  8 20:31:12 host2 pure-ftpd[970004]: (?@195.184.76.204) [INFO] New connection from 195.184.76.204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:31:23 host2 sshd[970379]: Disconnected from invalid user raul 103.59.94.124 port 34324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:32:47 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<hYI3lxZDquhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:32:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hw6plhZDJoyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:34:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<vTvzmxZDhGQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 20:34:12 host2 sshd[973768]: Disconnected from invalid user baby 62.60.131.157 port 34869 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Phh6phZDfqpD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:37:45 host2 sshd[977830]: Disconnected from invalid user daniil 103.59.94.124 port 52288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:39:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3DWRsBZDotmP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:39:18 host2 sshd[979422]: Disconnected from invalid user user 103.59.94.124 port 45434 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:40:32 host2 sshd[980773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 20:40:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<mk9XshZDurNnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 20:42:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<6isruhZD9LnRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:42:52 host2 sshd[983005]: Disconnected from invalid user webmaster 45.78.216.103 port 55488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:43:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lslSvhZD3rFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:44:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<pRyjwhZDpLJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:45:28 host2 sshd[986233]: Disconnected from invalid user test_user 45.78.216.103 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 20:45:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Myp5xRZDUsov+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 20:47:49 host2 sshd[988647]: Disconnected from invalid user wang 102.176.81.29 port 49266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 20:48:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<HC+lzxZDox4vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 20:49:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dKlr1BZDsaUz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:51:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<Jfml2BZDbrsBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:51:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uPUE2RZD9JqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:50:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<y1kJ1hZDaJexiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:51:26 host2 sshd[992460]: Disconnected from invalid user njs 81.30.162.18 port 46869 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:52:41 host2 sshd[993778]: Disconnected from invalid user harry 81.30.162.18 port 60550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 20:53:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CIsB4hZDgrK2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:53:59 host2 sshd[995141]: Disconnected from invalid user sebastian 81.30.162.18 port 45995 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:54:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hiGQ4xZDjs6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 20:55:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<gBKE6RZDML5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:59:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<64ns9hZDhoQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 21:02:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TMcIABdDIzdniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.137
country_id: 2635167
description:
Nov  8 21:02:25 host2 pure-ftpd[1004344]: (?@87.236.176.137) [INFO] New connection from 87.236.176.137


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 21:02:31 host2 sshd[1004485]: Disconnected from invalid user baby 62.60.131.157 port 46912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:02:40 host2 sshd[1004605]: Disconnected from invalid user dev 102.176.81.29 port 42436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 21:03:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2qaPBBdDeKlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 21:04:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fzyOBxdDALGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:04:13 host2 sshd[1006626]: Disconnected from invalid user njs 102.176.81.29 port 46502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:05:06 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:58264: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 21:05:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<XUtZDRdDwKgrZDwA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Nov  8 21:06:05 host2 pure-ftpd[1009107]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-08 21:05:23 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:54532: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:05:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xqS0CxdDnJqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:07:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hkN0EhdDYKqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 21:09:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uST+GBdDGJYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 21:08:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<4liiGBdDoso+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 21:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<NOHgGRdDJtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:09:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<W1joGRdDFKFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:11:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<69XxIhdD2r0+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 21:13:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Yv+TKRdDjs1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 21:14:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<D+XCKhdDmo9CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 21:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2BSeNRdD+r0rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 21:16:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<s2aQMhdDQo4r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:16:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<TqgZMxdDONM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:17:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<krvKOBdDFMBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 21:23:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<EGwLTBdDAKxm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:03 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ucFCUhdD4NFBMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:22 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oB9cUxdDPuxBMQGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 21:26:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<EWT/VxdD1LBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 21:27:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<324GWxdDzuCi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 21:27:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<iIT8WxdDUq2OtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:29:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<fY+DYBdD/uxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 21:29:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<RNmgYRdDTKul0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-08 21:33:13 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:33550: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-08 21:33:35 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54518: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:34:31 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:57014: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:34:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uGa+dBdDQudK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:35:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Pb2bdhdDprWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:36:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jAS9ehdD2uGP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  8 21:36:31 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<U8xCexdDj/7CpRCl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:36:52 host2 sshd[1043041]: Disconnected from invalid user user1 152.32.129.136 port 54972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 21:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<RaIOfRdDXsVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 21:38:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<SD9JgRdDVqwBFNmn>


