# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:02:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<nDyIWgFFSD6nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-03 06:03:04 dovecot_login authenticator failed for ([127.0.0.1]) [49.0.40.238]:39642: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 06:05:44 host2 sshd[2555171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:07:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7xiqawFF2JAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 06:09:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<W7xBcwFFs5Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 06:09:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<W8lbcwFFxNzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 06:10:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<c+czdgFFlNnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 06:11:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<tjBbdwFFbJKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 06:11:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<3tv1eQFFdqdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 06:14:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<MtD3hAFF/uiiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 06:16:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<RswriQFFOKkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.42
country_id: 3042225
description:
2025-12-03 06:18:29 dovecot_login authenticator failed for (ADMIN) [91.90.124.42]:28141: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 06:18:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<d2mFkwFFqMgv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 06:19:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<J69ylQFFsMMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 06:19:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</rIKlgFFqNo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 06:20:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<keRzmAFFmpYm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 06:21:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AfvgnAFFYKekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 06:21:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<it6hnQFFHoOB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 06:23:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<goBlowFFSp2OXXSy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Dec  3 06:23:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<WmJdpQFFtJunXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-03 06:25:58 dovecot_login authenticator failed for ([51.162.194.94]) [182.95.174.18]:41410: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 06:27:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<aLkSsQFFsMcvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:29:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iKZBuQFFbGunYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-03 06:29:02 dovecot_login authenticator failed for ([68.71.243.10]) [177.128.209.48]:52338: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.193
country_id: 1733045
description:
2025-12-03 06:29:17 dovecot_login authenticator failed for (host-86-111-91-69.566f.la.net.ua) [49.124.148.193]:58910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.232
country_id: 6252001
description:
Dec  3 06:30:05 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=44.220.188.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YXiauwFFwNMs3Lzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:32:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+xlbxQFFruYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 06:32:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<TCMSxAFF2NgvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 06:35:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wh/6zQFFcLkz0msW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.161.174.170
country_id: 6251999
description:
Dec  3 06:34:54 host2 pure-ftpd[2572690]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.161.174.170
country_id: 6251999
description:
Dec  3 06:35:11 host2 pure-ftpd[2573027]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 06:36:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hXAc0wFFMKzD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 06:36:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<KiBn0wFFVKPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.6
country_id: 3194884
description:
2025-12-03 06:36:48 dovecot_login authenticator failed for (ADMIN) [176.125.229.6]:10740: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 06:38:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5iNy2gFFnNpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 06:38:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<1iXh2gFF3Jel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 06:40:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<KDYu4QFFnO2iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-03 06:44:18 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:58248: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-03 06:44:34 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:38784: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 06:44:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<bp277wFFBKIv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 06:45:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<Ztry8gFFOJsm9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 06:46:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55398: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 06:46:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<SX359gFFDpQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 06:48:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OLyT+wFFaMukXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-03 06:48:11 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (fleuddy) [67.172.54.29]:36236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-03 06:48:14 dovecot_plain authenticator failed for (verbuchent) [24.93.140.162]:57842: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 06:48:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<4EA1/QFFkrrANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 06:49:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<3p9j/wFFuLiB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 06:49:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<0wTc/wFFsqaOXXSy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 06:50:54 host2 sshd[2580922]: Disconnected from invalid user user 2.57.121.25 port 31427 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.72.52
country_id: 2921044
description:
Dec  3 06:52:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.72.52, lip=66.85.158.91, TLS, session=<QscOCwJFjuuGekg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 06:53:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<LN0lDwJF6sEvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:56:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<LciNGQJFTiKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 06:57:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<svPwGwJF5N0+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.48
country_id: 3703430
description:
2025-12-03 06:57:18 dovecot_login authenticator failed for (ADMIN) [91.90.126.48]:50964: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-03 06:58:48 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (vioninglo) [87.103.126.54]:17364: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:58:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<edm9HwJFwpUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 06:58:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<1r0NIgJF/NA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:00:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<gYXWKQJFueIz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:01:14 host2 sshd[2588126]: Disconnected from invalid user server 103.105.176.66 port 38410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:01:27 host2 sshd[2588329]: Disconnected from invalid user jenkins 103.23.199.128 port 38216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 07:02:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Eqh8LwJFBsovWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:02:33 host2 sshd[2588903]: Disconnected from invalid user backend 103.105.176.66 port 46908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:02:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<easYMAJFrrnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:03:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<1uEjMgJFCJLO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:03:50 host2 sshd[2590268]: Disconnected from invalid user reza 103.105.176.66 port 45376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:04:53 host2 sshd[2590758]: Disconnected from invalid user teamspeak 103.23.199.128 port 46694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 07:06:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<iQZcPAJFAuZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:06:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<SrxiPgJFFKWiAOAm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:06:42 host2 sshd[2592098]: Disconnected from invalid user testing 103.23.199.128 port 45814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-03 07:06:01 dovecot_login authenticator failed for ([183.171.154.31]) [122.186.64.86]:36656: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:07:13 host2 sshd[2592417]: Disconnected from invalid user mika 103.72.147.99 port 43160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 07:07:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<gjYrQQJFLOil0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:08:29 host2 sshd[2593240]: Disconnected from invalid user aaa 103.72.147.99 port 35242 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-03 07:08:33 dovecot_login authenticator failed for ([219.138.200.44]) [103.90.27.83]:55174: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec  3 07:09:33 host2 sshd[2593989]: Disconnected from invalid user fan 12.189.234.28 port 46216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:09:43 host2 sshd[2594065]: Disconnected from invalid user runner 103.72.147.99 port 35954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-03 07:09:20 dovecot_login authenticator failed for (azteca-comunicaciones.com) [103.90.27.83]:40504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.3
country_id: 3042058
description:
2025-12-03 07:17:57 dovecot_login authenticator failed for (ADMIN) [91.90.122.3]:57570: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 07:18:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<eXflZgJFnuLANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 07:19:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<J8rGbAJFgLsvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 07:23:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E0CFewJFOqov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 07:22:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MHeaeAJF3oKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:26:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<NGOrhgJFWJ8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 07:28:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<7SP/jAJFuLI+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.230
country_id: 3017382
description:
Dec  3 07:28:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.230, lip=66.85.158.92, session=<mQEPjQJFS6Nb51nm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.76
country_id: 3017382
description:
Dec  3 07:28:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.76, lip=66.85.158.92, session=<a2asjQJFS59b51lM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:29:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<NqU0jgJF0uLD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.231
country_id: 3017382
description:
Dec  3 07:29:02 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.231, lip=66.85.158.92, session=<QClzjgJFCapb51nn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.227
country_id: 3017382
description:
Dec  3 07:29:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.227, lip=66.85.158.92, session=<v2CljgJFe7db51nj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:29:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lMgOkQJFdsnO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.122.51
country_id: 6252001
description:
Dec  3 07:32:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.122.51, lip=66.85.158.91, session=<z1gmmQJFBNVo+Hoz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 07:33:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<wMHdnQJFFLsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:33:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<n8HEnAJFlr6iAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 07:33:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9amknQJFJpRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 07:36:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<JGVTqAJFioel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 07:36:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<1lflqQJF3qEm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 07:37:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MTHdrAJFhucXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 07:36:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<6QUxqgJF+KUv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Dec  3 07:38:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<7CSFrwJFwrlHBobm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 07:40:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uVy3uAJF+MykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 07:40:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<VSHSuAJFELGOXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.67
country_id: 2510769
description:
2025-12-03 07:41:05 dovecot_login authenticator failed for (ADMIN) [212.102.49.67]:53867: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 07:42:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DbyxvQJFcqYrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.122.51
country_id: 6252001
description:
Dec  3 07:42:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.122.51, lip=66.85.158.92, session=<3TnRvAJFHqdo+Hoz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 07:44:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<rd9qxgJFioiB4rs4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:45:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LK2+xwJFGskjy9Nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:45:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<Sb6kygJFWP4jy9Nz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 07:45:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<H7WzygJF7LQvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 07:47:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<VhOV0QJFHrrANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 07:49:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kH4/2AJFiJ8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 07:50:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Tj1y2QJFDJSnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-03 07:51:30 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:53804: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:51:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS, session=<Xd6L4AJFUOsjy9Nz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-03 07:52:13 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:57052: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:53:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Vs0i5AJFi8kz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:55:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<5M0m7AJFrt3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:56:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<XcaT8AJFKKvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:59:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<NQ3i+wJF5IiiAOAm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 07:59:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SvVD/AJFxNUjy9K9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:00:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 27 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<P9MT/wJFeuwjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 08:00:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dNOh/wJFxMtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 07:59:50 host2 dovecot[2304439]: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts in 177 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<PdIQ8gJFJKnKm18C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:00:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Npd7AANFGPQjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 08:02:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<Wqi2BQNF7qQm9w7I>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Dec  3 08:01:52 host2 sshd[2630409]: Disconnected from invalid user fan 186.233.118.22 port 41212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 08:03:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<ah+1CANFZLQv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.197
country_id: 6252001
description:
2025-12-03 08:03:24 dovecot_login authenticator failed for (ADMIN) [191.101.61.197]:11330: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 08:04:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<jYStDANFSKwvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 08:04:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<1RDsDQNFdpY+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 08:05:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Q7ADEQNFDNs+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 08:04:49 host2 sshd[2632218]: Disconnected from invalid user admin 2.57.121.112 port 63625 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 08:05:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<TR7RDwNFTqil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 08:07:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<FrqGFgNFVLSOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 08:07:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<b75KGANFCr4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 08:07:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<imOZGANFkI+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 08:09:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<nfBGHgNF8V1RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:08:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS, session=<623YHANFwPQjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 08:10:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<Qt0aIgNFfKsrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Dec  3 08:11:00 host2 sshd[2636628]: Disconnected from invalid user valheim 158.174.211.17 port 22477 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 08:12:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<sA7wKQNFhK4vWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 08:12:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<ETxAKgNFUoeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.226.5
country_id: 3469034
description:
Dec  3 08:16:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=168.0.226.5, lip=66.85.158.91, TLS, session=<E+UiNgNFRL6oAOIF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.106
country_id: 3469034
description:
Dec  3 08:16:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.251.106, lip=66.85.158.91, TLS, session=<b5lnNwNFi+u60ftq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Dec  3 08:17:10 host2 sshd[2641300]: Disconnected from invalid user kingbase 158.174.211.17 port 26026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 08:17:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<6YQWOwNFAJWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 08:19:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ldnwQgNFLYYz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.3
country_id: 3469034
description:
Dec  3 08:21:21 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.11.251.3, lip=66.85.158.91, TLS, session=<kO9uSANFHK6xC/sD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.90.150
country_id: 3469034
description:
Dec  3 08:21:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.22.90.150, lip=66.85.158.91, TLS, session=<vyeoSQNFPsuxFlqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 08:21:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9952SwNFFqDD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 08:23:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<+8W3UANFttfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.7.29.204
country_id: 2205218
description:
2025-12-03 08:24:12 dovecot_plain authenticator failed for broadband-dynamic-central-210-7-29-204.connect.com.fj (D5USN7IUSI1V) [210.7.29.204]:47627: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.235
country_id: 718075
description:
2025-12-03 08:24:47 dovecot_login authenticator failed for (ADMIN) [185.225.28.235]:1314: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2025-12-03 08:25:52 dovecot_plain authenticator failed for (psysoodhed) [196.219.216.146]:41090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 08:26:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<chM2XANFRJuiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 08:28:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tfFsYwNF/M9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 08:28:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<doYoYgNF7qcm9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-03 08:29:55 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (prozintaby) [87.103.126.54]:25944: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 08:29:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<IpFIZwNFXtov+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 08:33:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<DjsOdQNF/J+OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 08:34:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<IwJIeQNFht+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 08:34:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<NS4QegNFJril0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 08:35:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<BijnfANFPJ0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.227.65.166
country_id: 3469034
description:
Dec  3 08:36:12 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=168.227.65.166, lip=66.85.158.91, TLS, session=<mR6tfQNFOc+o40Gm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.152
country_id: 953987
description:
Dec  3 08:36:33 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.45.152, lip=66.85.158.91, TLS, session=<1nTUfgNF28lmQC2Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 08:38:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hg2/hgNFvLIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 08:39:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Z7fQiQNFVoo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 08:39:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<tib7iQNFeKgvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 08:40:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<eX4IjwNFWKiB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-03 08:41:11 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (duchypeky) [73.145.107.251]:49896: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 08:42:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<IrmLlANFpoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 08:44:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dIe+nQNFCgSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 08:46:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<+PgPowNF7rEz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.125
country_id: 2960313
description:
2025-12-03 08:46:40 dovecot_login authenticator failed for (ADMIN) [37.46.113.125]:41411: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.157.172.114
country_id: 1327865
description:
2025-12-03 08:47:09 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [204.157.172.114]:10643: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 08:47:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<kh9EpwNFRqnANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-03 08:47:46 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.10.140]:59484: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-03 08:47:53 dovecot_login authenticator failed for ([127.0.0.1]) [187.161.213.35]:37869: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 08:48:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<m76LqwNFcufD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 08:50:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<YQuFsQNFiLTO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Dec  3 08:53:37 host2 sshd[2667745]: Disconnected from invalid user dev 156.54.170.192 port 36678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 08:53:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<L/zLvQNFoJKiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 08:54:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<KAJivwNFeqsm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 08:56:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<i5AjyANFRuRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 08:56:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<v9L1xgNFUsMv+44t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Dec  3 08:56:38 host2 sshd[2670405]: Disconnected from invalid user node 156.54.170.192 port 60473 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-03 08:56:40 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:52816: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-03 08:57:04 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:34788: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 08:58:47 host2 sshd[2671763]: Disconnected from invalid user user 2.57.121.25 port 41119 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.170.192
country_id: 3175395
description:
Dec  3 08:58:50 host2 sshd[2671800]: Disconnected from invalid user user 156.54.170.192 port 58400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 09:00:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<V00H1QNFHteOXXSy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec  3 09:00:36 host2 sshd[2673507]: Disconnected from invalid user superset 185.118.15.236 port 60920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec  3 09:01:46 host2 sshd[2674563]: Disconnected from invalid user production 185.118.15.236 port 32796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.118.15.236
country_id: 130758
description:
Dec  3 09:02:54 host2 sshd[2675409]: Disconnected from invalid user roots 185.118.15.236 port 32898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 09:02:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<kX912wNFhOKkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Dec  3 09:03:03 host2 sshd[2675571]: Disconnected from invalid user nagios 156.54.170.192 port 54241 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.22.23
country_id: 6252001
description:
2025-12-03 09:03:50 dovecot_login authenticator failed for (ADMIN) [158.173.22.23]:40306: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 09:04:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<+WtC5QNFpJel0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec  3 09:05:05 host2 sshd[2677381]: Disconnected from invalid user userm 185.118.15.236 port 33114 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 09:06:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<9PjG6wNFcKIvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 09:07:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<rG9U7QNFsIUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 09:08:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<0NN78ANFgo8vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 09:09:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<bzwP9ANFvoeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 09:09:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<++7L9ANFNrkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  3 09:10:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<eTia+QNFJP7CpRCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:12:11 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<SJlT/wNFBq0DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 09:13:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<x4OQBQRFRqY+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:13:15 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<rE4jAwRFoJEDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 09:13:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<CEmhAwRF2GGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 09:13:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<+WqtBARFZN4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 09:14:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<OV3XBQRFEqM+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:14:32 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<zAHABwRFpowDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:15:19 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<djqSCgRF4LgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:16:25 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VT13DgRFWLwDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:16:39 host2 dovecot[2304439]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<UuJKDwRFLuYDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 09:16:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<DRwwDQRFTOLD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 09:17:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<xwoHEwRF8OPANXk9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:17:46 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<m5ZKEwRF7KkDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 09:17:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<qGKQEwRFNK3O7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.23
country_id: 1880251
description:
Dec  3 09:18:04 host2 sshd[2687100]: Disconnected from invalid user ben 45.78.228.23 port 45934 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:19:53 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<a0rmGgRFGOUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.99
country_id: 6252001
description:
Dec  3 09:20:36 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.99, lip=66.85.158.91, TLS, session=<ZTd2HQRFjOCTuYRj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 09:20:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<ezrBHQRFCq8m9w7I>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:19:57 host2 dovecot[2304439]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2/cgGwRFwpkDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Dec  3 09:20:00 host2 sshd[2688153]: Disconnected from invalid user mega 68.183.224.170 port 36728 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  3 09:20:58 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<e028HgRFtKwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec  3 09:21:14 host2 sshd[2689185]: Disconnected from invalid user admin 193.106.245.20 port 46139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec  3 09:21:22 host2 sshd[2689308]: Disconnected from invalid user stperez 68.183.224.170 port 37082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 09:21:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<803GIARFCo2iAOAm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec  3 09:21:55 host2 sshd[2689723]: Disconnected from invalid user pivpn 172.208.24.217 port 51380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec  3 09:22:08 host2 sshd[2689860]: Disconnected from invalid user controlm 193.106.245.20 port 56896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.161
country_id: 102358
description:
2025-12-03 09:22:37 dovecot_login authenticator failed for (ADMIN) [95.181.235.161]:61796: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 09:23:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<HfnvJwRFlJEv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 09:25:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<EN7qLwRFl7xRvaKO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 09:25:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<t88BLgRFvp1nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-03 09:26:50 dovecot_login authenticator failed for ([182.95.24.209]) [128.185.197.178]:40252: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Dec  3 09:26:14 host2 sshd[2693078]: Disconnected from invalid user devuser 193.106.245.20 port 57102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2025-12-03 09:26:33 dovecot_login authenticator failed for ([217.195.94.243]) [136.228.168.12]:53690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec  3 09:27:14 host2 sshd[2693798]: Disconnected from invalid user ben 193.106.245.20 port 39635 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 09:27:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<KQAsNgRFctuOXXSy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec  3 09:27:55 host2 sshd[2694437]: Disconnected from invalid user develop 172.208.24.217 port 60980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 09:29:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<HnbjPgRFsNOkXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec  3 09:30:27 host2 sshd[2696745]: Disconnected from invalid user controlm 172.208.24.217 port 11466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.23
country_id: 1880251
description:
Dec  3 09:32:25 host2 sshd[2698370]: Disconnected from invalid user remote 45.78.228.23 port 41574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 09:34:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<tmiETgRFTpwvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 09:35:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<iAOCUQRFzsil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 09:36:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<TPQ+VgRF1u0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 09:36:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DpJgVgRFBpYrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.23
country_id: 1880251
description:
Dec  3 09:37:09 host2 sshd[2702337]: Disconnected from invalid user develop 45.78.228.23 port 49838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 09:37:35 host2 sshd[2702763]: Disconnected from invalid user admin 2.57.121.112 port 48420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 09:37:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<V1YOWwRFDOGB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 09:39:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<VCwWYgRFQoEvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 09:41:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<k9tOZwRFJp0z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 09:41:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Fg3qZwRFzH2nYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.105.70.190
country_id: 3017382
description:
Dec  3 09:41:42 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=46.105.70.190, lip=66.85.158.92, TLS: Connection closed, session=<x4rpaARFGcMuaUa+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 09:43:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<RC5zbwRFYrvD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Dec  3 09:44:13 host2 sshd[2707796]: Disconnected from invalid user jmarquez 45.78.228.110 port 59486 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.5
country_id: 2750405
description:
Dec  3 09:43:59 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.5, lip=66.85.158.92, session=<KlEVcQRF9+sfDiAF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.238
country_id: 1880251
description:
Dec  3 09:44:06 host2 sshd[2707696]: Disconnected from invalid user ali 45.78.207.238 port 45662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 09:45:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<uu3mdgRF9qjO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 09:47:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<pFrNfARFqLIm9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.26
country_id: 146669
description:
2025-12-03 09:47:35 dovecot_login authenticator failed for (ADMIN) [185.253.162.26]:8411: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Dec  3 09:47:39 host2 sshd[2710878]: Disconnected from invalid user victor 45.78.228.110 port 46614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Dec  3 09:48:39 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.207, lip=66.85.158.91, session=<wdPEgQRFtPrG6xjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 09:48:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<NCdTfwRFEO3ANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 09:49:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<S1hahARFsoWiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 09:50:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<MkpCiQRFJOsv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 09:52:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</fWYjwRFAO4+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 09:54:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yxsYlQRFXqBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 09:54:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<WlstmARFHK+OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 09:58:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<jcONowRFmtekXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.110
country_id: 1880251
description:
Dec  3 09:59:25 host2 sshd[2725833]: Disconnected from invalid user seafile 45.78.228.110 port 48762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.238
country_id: 1880251
description:
Dec  3 10:01:02 host2 sshd[2727117]: Disconnected from invalid user bob 45.78.207.238 port 58574 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.109
country_id: 6252001
description:
Dec  3 10:01:34 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<60L1rwRFM8CTuYRt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 10:02:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<Kw20sgRFTpYvWGUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-12-03 10:04:03 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:46524: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.53.36.35
country_id: 718075
description:
2025-12-03 10:04:12 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [92.53.36.35]:3359: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 10:04:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<QZBuuQRFUN4v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.33.2
country_id: 6252001
description:
2025-12-03 10:04:18 dovecot_plain authenticator failed for ([10.19.18.99]) [84.239.33.2]:59654: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 10:05:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<bKVbvgRFvtml0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.33.2
country_id: 6252001
description:
2025-12-03 10:05:49 dovecot_plain authenticator failed for ([10.19.18.99]) [84.239.33.2]:56658: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 10:06:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<93ejwARFgKwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 10:07:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<nLHAwwRF8pyB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.33.2
country_id: 6252001
description:
2025-12-03 10:08:38 dovecot_login authenticator failed for ([10.19.18.99]) [84.239.33.2]:56658: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Dec  3 10:08:42 host2 sshd[2732631]: Disconnected from invalid user vpnuser 45.78.228.110 port 59622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.43
country_id: 660013
description:
2025-12-03 10:09:01 dovecot_login authenticator failed for (ADMIN) [188.126.89.43]:63316: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 10:09:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<DvEqywRF28oz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Dec  3 10:11:03 host2 sshd[2734525]: Disconnected from invalid user administrator 181.188.172.6 port 37977 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 10:11:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<oxwE1ARF4oXD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 10:12:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<eChl1wRFvnMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 10:17:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<8u9J6gRFft+iAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 10:18:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<Z84d7ARFSLEv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 10:18:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<n1k+7QRFuonANXk9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 10:21:43 host2 sshd[2741945]: Disconnected from invalid user baylie 62.60.131.157 port 41154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 10:22:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<KL/9+wRFkr2OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.101.69
country_id: 3057568
description:
Dec  3 10:23:17 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.134.101.69, lip=66.85.158.91, TLS, session=<Yw2o/ARFoa8fhmVF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.236
country_id: 3469034
description:
Dec  3 10:23:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=187.120.73.236, lip=66.85.158.91, TLS, session=<i0d4+wRFzNe7eEns>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 10:23:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TF5X/QRFjp1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 10:25:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<9PoGBQVF4us+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 10:25:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<NsuEBgVFjNg+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 10:25:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59008: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 10:26:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OpVqCAVFLuOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.85.199
country_id: 1168579
description:
2025-12-03 10:27:19 dovecot_plain authenticator failed for static-host119-30-85-199.link.net.pk (10I184C09IJ1) [119.30.85.199]:55300: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.44
country_id: 2264397
description:
2025-12-03 10:27:40 dovecot_login authenticator failed for (ADMIN) [146.70.59.44]:2092: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 10:29:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<ImLrFAVFTpEvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 10:31:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<tAoqGgVFDuAv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.125.109
country_id: 6252001
description:
Dec  3 10:33:53 host2 pure-ftpd[2752674]: (?@159.223.125.109) [INFO] New connection from 159.223.125.109


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 10:34:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<b8ylJgVFtsGl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 10:34:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ttf2JgVFgokrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 10:35:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<jH45KQVFOYcz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 10:35:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<dZ5HKAVFPNKB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 10:38:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ZuUfMgVFLLDD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-03 10:39:02 dovecot_plain authenticator failed for (crompect) [23.30.11.253]:41707: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec  3 10:39:13 host2 sshd[2757830]: Disconnected from invalid user ubuntu 187.174.238.116 port 46130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.12
country_id: 798544
description:
Dec  3 10:39:20 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=89.231.35.12, lip=66.85.158.91, TLS, session=<7wz2NQVFwplZ5yMM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.124
country_id: 298795
description:
Dec  3 10:39:39 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.67.155.124, lip=66.85.158.91, TLS, session=<SmgdNwVFD+4tQ5t8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 10:40:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<tNAyPAVFirsm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 10:41:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<cOiMPQVFVKvO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec  3 10:41:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sgzRPQVF0HFChJmI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Dec  3 10:41:47 host2 sshd[2760934]: Disconnected from invalid user gg 187.174.238.116 port 49102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 10:43:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<3XRYRAVFfGQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 10:43:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<GGZSRgVF8N6iAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 10:43:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<1qFFRgVF1pgv+44t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec  3 10:42:59 host2 sshd[2761990]: Disconnected from invalid user user 187.174.238.116 port 50578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec  3 10:45:17 host2 sshd[2764535]: Disconnected from invalid user ubuntu 187.174.238.116 port 53536 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 10:46:14 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.93
country_id: 2921044
description:
2025-12-03 10:46:34 dovecot_login authenticator failed for (ADMIN) [191.101.157.93]:51219: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 10:47:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<07DFVAVFht6OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 10:48:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<INihVgVFGrDANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 10:49:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<W15XWwVFmqJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 10:51:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ypEPYwVFws6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 10:54:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<59Y7bQVFmnenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 10:54:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<Cs0obgVFCoovWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 11:00:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<NgdQgQVFqa4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 11:01:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<snplhgVFXKMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 11:01:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<EJn/hgVF6OiB4rs4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 11:01:53 host2 sshd[2776387]: Disconnected from invalid user admin 2.57.121.112 port 37461 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 11:02:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<TLFeiAVFNqul0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 11:02:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<koDcigVFppY+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 11:03:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<KVK2iwVF2IjD+hnW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 11:04:51 host2 sshd[2779194]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.205
country_id: 798544
description:
2025-12-03 11:04:26 dovecot_login authenticator failed for (ADMIN) [138.199.59.205]:36672: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 11:06:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<APXJmQVFCr8m9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.208.149.246
country_id: 130758
description:
2025-12-03 11:07:30 dovecot_plain authenticator failed for (axian) [188.208.149.246]:37324: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 11:08:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<zCZjngVFiKbO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 11:08:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<QguqngVFAMIv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 11:08:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<V7QuoAVFQuKiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-12-03 11:10:41 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:41022: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.209.123
country_id: 1819730
description:
Dec  3 11:11:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=152.32.209.123, lip=66.85.158.91, session=<xHBYqAVF5GGYINF7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-03 11:11:58 dovecot_login authenticator failed for (server1.kamon.la) [182.95.176.206]:40038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-03 11:11:08 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:47712: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 11:12:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<viCerAVFAoCOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 11:12:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<k3LarQVFqlQvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.110
country_id: 3017382
description:
Dec  3 11:13:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=94.231.206.110, lip=66.85.158.92, session=<XYuprwVFH6Je585u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.36
country_id: 3017382
description:
Dec  3 11:13:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.36, lip=66.85.158.92, session=<qQZIsAVFCZNe584k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 3017382
description:
Dec  3 11:13:25 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<XUnwsAVF3Y1e584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.105
country_id: 3017382
description:
Dec  3 11:13:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.105, lip=66.85.158.92, session=<v8cjsQVFCade585p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 11:15:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XOY3uQVFQIRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.59.131
country_id: 1821275
description:
2025-12-03 11:15:49 dovecot_login authenticator failed for ([127.0.0.1]) [182.93.59.131]:39488: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-03 11:15:35 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.119.118]:39358: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec  3 11:16:15 host2 sshd[2788871]: Disconnected from invalid user temp 198.98.51.235 port 45178 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 11:17:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<1CybvQVF5uukXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec  3 11:17:27 host2 sshd[2789545]: Disconnected from invalid user sysadmin 81.30.162.18 port 58603 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.75
country_id: 6290252
description:
Dec  3 11:19:07 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=109.206.97.75, lip=66.85.158.91, TLS, session=</LZPxAVFjIltzmFL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.62
country_id: 953987
description:
Dec  3 11:19:29 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.63.62, lip=66.85.158.91, TLS, session=<pJ91xQVFTbVmgT8+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec  3 11:19:37 host2 sshd[2790955]: Disconnected from invalid user administrator 198.98.51.235 port 52756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec  3 11:19:48 host2 sshd[2791052]: Disconnected from invalid user admin1 81.30.162.18 port 56060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 11:19:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<CVb6xwVF6oIvWGUU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.51.235
country_id: 6252001
description:
Dec  3 11:20:41 host2 sshd[2791894]: Disconnected from invalid user ubuntu 198.98.51.235 port 43212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 11:21:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<sz+9zAVFeMsv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec  3 11:21:43 host2 sshd[2792515]: Disconnected from invalid user alex 198.98.51.235 port 52330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec  3 11:21:51 host2 sshd[2792582]: Disconnected from invalid user mike 81.30.162.18 port 53345 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.51.235
country_id: 6252001
description:
Dec  3 11:22:44 host2 sshd[2793061]: Disconnected from invalid user usuario2 198.98.51.235 port 56160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.218.164.192
country_id: 2635167
description:
Dec  3 11:23:15 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.218.164.192, lip=66.85.158.91, session=<QIAS1AVFwtpo2qTA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 11:24:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<uTfg2AVFgdUz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Dec  3 11:25:07 host2 sshd[2794860]: Disconnected from invalid user free 81.30.162.18 port 35165 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.218.164.192
country_id: 2635167
description:
Dec  3 11:26:00 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.218.164.192, lip=66.85.158.92, session=<V4vk3QVFjs5o2qTA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.218.164.192
country_id: 2635167
description:
Dec  3 11:26:19 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.218.164.192, lip=66.85.158.92, session=</10H3wVFkKNo2qTA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-03 11:26:55 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:40516: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 11:27:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<14nB5AVFrreB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 11:28:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<+q4U5gVFSKYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 11:28:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<N23F5gVFNtnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 11:29:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<xgyh6gVFkIel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 11:29:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qKzP6gVFFiynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 11:30:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<5oJY7wVFrsQ+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 11:33:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<5vYE9wVFysIm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 11:33:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<2PUI9wVFupwv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 11:32:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<KZG29AVFjLg+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-03 11:33:39 dovecot_login authenticator failed for ([127.0.0.1]) [188.124.139.77]:36638: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-03 11:33:46 dovecot_login authenticator failed for ([127.0.0.1]) [189.219.138.45]:56504: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 11:33:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<rcKw+QVFYLmiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 11:35:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Y+GZ/gVF6NXO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.56
country_id: 1733045
description:
2025-12-03 11:36:34 dovecot_login authenticator failed for ([119.160.166.237]) [49.124.153.56]:39334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-12-03 11:36:56 dovecot_login authenticator failed for ([152.52.224.26]) [190.104.24.6]:48354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 11:37:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<hMWsBQZFwpOOXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-03 11:38:10 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (dippes) [85.225.19.144]:55673: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.239
country_id: 6252001
description:
Dec  3 11:38:20 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.104.239, lip=66.85.158.91, session=<RD0KCgZFMsMUqWjv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-03 11:40:39 dovecot_login authenticator failed for ([116.38.54.26]) [201.183.225.156]:51795: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.20
country_id: 1733045
description:
2025-12-03 11:40:27 dovecot_login authenticator failed for (190-231-102-91.reverse.sattrakt.net) [49.124.151.20]:47484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 11:42:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sOIXFwZFpItnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 11:42:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<OlKGFwZFqEQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 11:42:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Pkt1GAZFcuKkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec  3 11:43:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<HlJBHAZFpINChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 11:45:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<hJphIgZFLuovWGUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.76
country_id: 6252001
description:
Dec  3 11:45:18 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.76, lip=66.85.158.92, session=<kXjsIgZFCscUQcFM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 11:46:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<c268JQZFDqQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 11:46:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<TfQoJwZFVonANXk9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 11:48:09 host2 sshd[2809324]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-03 11:49:05 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:59022: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 11:49:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wLgEMQZFeo4z0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.98.91
country_id: 6252001
description:
Dec  3 11:50:09 host2 sshd[2810495]: Disconnected from invalid user samba 101.36.98.91 port 54476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Dec  3 11:52:21 host2 sshd[2811835]: Disconnected from invalid user dixi 101.36.98.91 port 51438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 11:53:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<5kxcQAZF2sHD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.172.196.177
country_id: 6252001
description:
Dec  3 11:54:16 host2 sshd[2813137]: Disconnected from invalid user dspace 172.172.196.177 port 47060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 11:54:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<XX9lQwZFzIWB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 11:55:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<LrXnRgZFUuMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 11:59:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<r4fuVAZFSMYm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 12:02:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<S4ACXwZFcI2OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 12:02:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<eBazXwZFsOnO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 12:02:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ar8HYgZFenCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.186
country_id: 1269750
description:
Dec  3 12:03:09 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=103.172.11.186, lip=66.85.158.91, TLS, session=<2uqrYQZFFYZnrAu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.48.12.87
country_id: 2510769
description:
Dec  3 12:03:28 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<isuru>, method=PLAIN, rip=83.48.12.87, lip=66.85.158.91, TLS, session=<soPaYgZFGZJTMAxX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.123
country_id: 6252001
description:
Dec  3 12:05:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.65.195.123, lip=66.85.158.91, session=<h9uMagZFtq8UQcN7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 12:07:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<zConcwZF6sSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 12:08:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JIKSdAZFTtJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 12:08:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</lKudQZFSMc+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.124
country_id: 1880251
description:
Dec  3 12:08:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.175.124, lip=66.85.158.92, session=<GHX4dQZF4egP6698>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.125
country_id: 1880251
description:
Dec  3 12:08:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=15.235.175.125, lip=66.85.158.92, session=<u9GWdgZFsZ8P6699>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.123
country_id: 1880251
description:
Dec  3 12:08:53 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=15.235.175.123, lip=66.85.158.92, session=<VLBNdwZFUZQP6697>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.116
country_id: 1880251
description:
Dec  3 12:08:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.175.116, lip=66.85.158.92, session=<6UGBdwZFX48P6690>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.198
country_id: 2960313
description:
2025-12-03 12:09:42 dovecot_login authenticator failed for (ADMIN) [37.46.113.198]:59741: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 12:10:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<rCK+ewZF7uIvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 12:11:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZP8YfwZFkJov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 12:11:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<gWAjgAZFcjQvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec  3 12:11:54 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<PLYJggZFTl6nXpI7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 12:13:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<RCZziAZFWLUz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.125.36
country_id: 1819730
description:
Dec  3 12:13:41 host2 sshd[2825957]: Disconnected from invalid user copia 101.36.125.36 port 35078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.189.96.48
country_id: 1168579
description:
2025-12-03 12:14:50 dovecot_plain authenticator failed for (56QUULLY) [182.189.96.48]:50905: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.125.36
country_id: 1819730
description:
Dec  3 12:14:59 host2 sshd[2826752]: Disconnected from invalid user proxyuser 101.36.125.36 port 10268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.125.36
country_id: 1819730
description:
Dec  3 12:16:17 host2 sshd[2827581]: Disconnected from invalid user dangulo 101.36.125.36 port 40372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-03 12:17:34 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:59727: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.125.36
country_id: 1819730
description:
Dec  3 12:17:41 host2 sshd[2828410]: Disconnected from invalid user ansible 101.36.125.36 port 15452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 12:17:54 host2 dovecot[2304439]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=202.155.95.2, lip=66.85.158.91, session=<6xCKlwZFOOLKm18C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 12:18:14 host2 sshd[2828814]: Disconnected from invalid user admin 2.57.121.112 port 31927 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 12:20:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<CnuroQZFUN6B4rs4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 12:20:31 host2 sshd[2830569]: Disconnected from invalid user  2.57.121.112 port 64050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 12:21:37 host2 sshd[2831134]: Disconnected from invalid user admin 2.57.121.112 port 55510 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 12:22:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<TG5MpgZFvMQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 12:23:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<1knSqgZF+ryiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.87
country_id: 3469034
description:
Dec  3 12:23:32 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.171.87, lip=66.85.158.91, TLS, session=<Ro+bqgZFst+xgqtX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 12:23:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<PVyFqwZFDuSl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.58
country_id: 3175395
description:
Dec  3 12:23:12 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.197.9.58, lip=66.85.158.91, TLS, session=<jDJ7qQZFR7m5xQk6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Dec  3 12:29:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<HJBgvwZF2NTE+2Qw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 12:29:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lKLmvwZFwODO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec  3 12:31:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JQf/yAZFc8STuYQw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.45.6.199
country_id: 1819730
description:
2025-12-03 12:32:11 dovecot_login authenticator failed for (ADMIN) [89.45.6.199]:41241: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 12:33:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<8YVwzgZFUJykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 12:34:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<L+Fz0gZFDJlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 12:35:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<lxkB1wZFsqo+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 12:37:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<LV5U3AZFph+nYwhf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec  3 12:38:19 host2 pure-ftpd[2842573]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 12:39:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<2qJE4wZFFNQ+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.83.10
country_id: 3175395
description:
2025-12-03 12:39:09 dovecot_login authenticator failed for ([127.0.0.1]) [2.194.83.10]:51308: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-03 12:39:21 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.12.159]:42912: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 12:41:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<F44/6wZFKiUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 12:44:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<1OZr9wZFtsfANXk9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.18
country_id: 6252001
description:
Dec  3 12:44:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.18, lip=66.85.158.92, session=<X4VD+AZFXKoNWX0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 12:47:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<7/RaAAdFCO2B4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 12:48:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<jMqcAwdFTKYrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.100
country_id: 2623032
description:
2025-12-03 12:48:11 dovecot_login authenticator failed for (ADMIN) [188.126.94.100]:35855: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 12:50:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<5na2CwdF6Oel0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.156.93.10
country_id: 6251999
description:
Dec  3 12:53:19 host2 sshd[2852117]: Disconnected from invalid user node 69.156.93.10 port 52882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-03 12:54:48 dovecot_login authenticator failed for ([106.245.192.206]) [85.117.232.42]:51038: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 12:55:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<d8aKHgdF6KzO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-12-03 12:55:05 dovecot_login authenticator failed for (45-181-101-92.plugartelecom.net.br) [115.245.172.214]:49626: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.156.93.10
country_id: 6251999
description:
Dec  3 12:58:00 host2 sshd[2856006]: Disconnected from invalid user temp 69.156.93.10 port 54166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.134
country_id: 3469034
description:
Dec  3 12:59:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=187.120.106.134, lip=66.85.158.91, TLS, session=<W/tjKQdFJI+7eGqG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.156.93.10
country_id: 6251999
description:
Dec  3 12:59:17 host2 sshd[2856798]: Disconnected from invalid user in 69.156.93.10 port 56544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.206.245.191
country_id: 798544
description:
Dec  3 12:59:17 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.206.245.191, lip=66.85.158.91, TLS, session=<wPWQKgdFz6VbzvW/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 13:01:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TB/XMgdFEtJnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Dec  3 13:02:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<LcE0NQdFUbwtT3OG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Dec  3 13:02:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<siNYNQdFUrwtT3OG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Dec  3 13:02:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, TLS, session=<M2rSNgdFQOOsaAsi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.156.93.10
country_id: 6251999
description:
Dec  3 13:03:55 host2 sshd[2860081]: Disconnected from invalid user client 69.156.93.10 port 37778 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec  3 13:04:09 host2 pure-ftpd[2860221]: (?@66.132.153.134) [INFO] New connection from 66.132.153.134


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.61.92
country_id: 1269750
description:
2025-12-03 13:04:39 dovecot_plain authenticator failed for (PMAJ2FF461FCD) [152.59.61.92]:57399: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 13:05:39 host2 sshd[2861231]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.49
country_id: 732800
description:
2025-12-03 13:07:44 dovecot_login authenticator failed for (ADMIN) [94.156.14.49]:38758: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.61.92
country_id: 1269750
description:
2025-12-03 13:08:19 dovecot_login authenticator failed for (PMAJ2FF461FCD) [152.59.61.92]:57399: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 13:08:52 host2 sshd[2863233]: Disconnected from invalid user user 2.57.121.25 port 37713 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 13:11:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hP9nVgdFphUvWbHj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  3 13:12:19 host2 pure-ftpd[2865832]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 13:12:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<LablWQdFSLqnYwhf>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  3 13:12:20 host2 pure-ftpd[2865851]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-03 13:12:42 dovecot_plain authenticator failed for (iricurate) [65.20.160.107]:52342: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 13:13:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<gsyqXgdF2pnANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 13:13:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<FiSQXwdFBtKB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 13:14:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<k1v6YQdFqo8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 13:14:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Cr5zYwdFLMI+PIdr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.176.155
country_id: 6252001
description:
Dec  3 13:16:36 host2 pure-ftpd[2868694]: (?@159.65.176.155) [INFO] New connection from 159.65.176.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 13:17:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<PQpbbAdFtJel0xnK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.176.155
country_id: 6252001
description:
Dec  3 13:21:04 host2 pure-ftpd[2871707]: (?@159.65.176.155) [INFO] New connection from 159.65.176.155


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec  3 13:22:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<f0+tfwdFFJLUZija>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.170.242
country_id: 6252001
description:
Dec  3 13:23:38 host2 pure-ftpd[2873236]: (?@157.230.170.242) [INFO] New connection from 157.230.170.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.254.165.85
country_id: 6252001
description:
Dec  3 13:23:59 host2 sshd[2873425]: Invalid user cloudtourssrilan_travel from 157.254.165.85 port 60040


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.103
country_id: 953987
description:
Dec  3 13:24:56 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.64.35.103, lip=66.85.158.91, TLS, session=<j7kNhgdF1eZmQCNn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.134
country_id: 690791
description:
Dec  3 13:25:14 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=37.221.157.134, lip=66.85.158.91, TLS, session=<XLVThwdFDO0l3Z2G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 13:25:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+ucfiQdFwLIXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.65
country_id: 6251999
description:
2025-12-03 13:27:21 dovecot_login authenticator failed for (ADMIN) [66.56.80.65]:61544: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.7.72.6
country_id: 130758
description:
Dec  3 13:27:58 host2 sshd[2876672]: Disconnected from invalid user temp 31.7.72.6 port 36990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec  3 13:28:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<P5BVlAdFLBBAPsUR>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.170.242
country_id: 6252001
description:
Dec  3 13:28:06 host2 pure-ftpd[2876852]: (?@157.230.170.242) [INFO] New connection from 157.230.170.242


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec  3 13:29:02 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<ijjqlQdFRGtAPsUR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.7.72.6
country_id: 130758
description:
Dec  3 13:34:23 host2 sshd[2881144]: Disconnected from invalid user proradis 31.7.72.6 port 32058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-03 13:35:32 dovecot_login authenticator failed for (p83212-obmd01.osaka.ocn.ne.jp) [78.188.102.28]:52034: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.7.72.6
country_id: 130758
description:
Dec  3 13:35:32 host2 sshd[2882027]: Disconnected from invalid user tony 31.7.72.6 port 53073 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-03 13:36:14 dovecot_login authenticator failed for ([70.166.167.58]) [128.185.211.102]:60262: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-03 13:36:44 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (shetreacal) [174.59.253.88]:39420: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.7.72.6
country_id: 130758
description:
Dec  3 13:37:40 host2 sshd[2883617]: Disconnected from invalid user in 31.7.72.6 port 58443 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 13:41:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<eRVdwgdFkJ0+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 13:41:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<XBNvwwdFYAYvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 13:44:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<mFvLywdF97VRvaKO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 13:44:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<lA56zQdFXO0+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.40
country_id: 1819730
description:
Dec  3 13:45:43 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.40, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3H2S0QdFUOMtjpoo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.78
country_id: 6252001
description:
Dec  3 13:45:08 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.78, lip=66.85.158.92, TLS, session=<Eq6EzwdFvKFC5DVO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.225.114.100
country_id: 6252001
description:
Dec  3 13:47:06 host2 pure-ftpd[2890750]: (?@64.225.114.100) [INFO] New connection from 64.225.114.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.205
country_id: 2510769
description:
2025-12-03 13:47:42 dovecot_login authenticator failed for (ADMIN) [212.102.49.205]:13980: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 13:48:56 host2 sshd[2891903]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 13:48:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qa/i3AdFCoWnYwhf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.225.114.100
country_id: 6252001
description:
Dec  3 13:51:33 host2 pure-ftpd[2893778]: (?@64.225.114.100) [INFO] New connection from 64.225.114.100


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 13:52:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<V8hE6gdFjpkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-03 13:56:00 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (gueots) [76.145.10.140]:53212: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.176
country_id: 798544
description:
Dec  3 13:55:44 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=193.192.179.176, lip=66.85.158.91, TLS, session=<pbJq9AdFf43BwLOw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.82.157.205
country_id: 1269750
description:
Dec  3 13:56:05 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.82.157.205, lip=66.85.158.91, TLS, session=<QP6Q9QdF1MtnUp3N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-03 13:59:55 dovecot_plain authenticator failed for (suburtlid) [102.53.15.180]:35912: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 14:00:41 host2 sshd[2900686]: Disconnected from invalid user carrington 62.60.131.157 port 55043 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-12-03 14:00:53 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:33952: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-03 14:01:41 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:59060: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.226
country_id: 6252001
description:
Dec  3 14:02:43 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.226, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ca5mDghFKOgUQcHi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 14:05:42 host2 sshd[2904346]: Disconnected from invalid user carrington 62.60.131.157 port 56412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.134
country_id: 2328926
description:
2025-12-03 14:06:55 dovecot_login authenticator failed for (ADMIN) [146.70.65.134]:57579: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.247
country_id: 798544
description:
Dec  3 14:09:17 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=91.231.121.247, lip=66.85.158.91, TLS, session=<hPvgJAhFeaxb53n3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.110
country_id: 690791
description:
Dec  3 14:09:36 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<isuru>, method=PLAIN, rip=176.103.2.110, lip=66.85.158.91, TLS, session=<MlD3JQhF6s+wZwJu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 14:11:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<BnLqLQhFpqfANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 14:11:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hdRqLghFl/AvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-03 14:16:18 dovecot_plain authenticator failed for (aggrative) [94.206.93.90]:38718: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.235
country_id: 2635167
description:
Dec  3 14:21:51 host2 pure-ftpd[2917940]: (?@87.236.176.235) [INFO] New connection from 87.236.176.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-03 14:22:34 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:40252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.166
country_id: 2413451
description:
2025-12-03 14:23:00 dovecot_login authenticator failed for (197-255-207-166.netpagedns.net) [197.255.207.166]:38785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-03 14:24:26 dovecot_login authenticator failed for ([103.55.89.5]) [177.128.209.48]:41282: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.64
country_id: 2963597
description:
2025-12-03 14:24:36 dovecot_login authenticator failed for (ADMIN) [155.2.194.64]:10843: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 14:24:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<e2x+WghFjKo+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-03 14:24:10 dovecot_login authenticator failed for ([136.228.168.12]) [149.54.15.42]:46936: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.6.216
country_id: 3144096
description:
2025-12-03 14:25:15 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.6.216]:38294: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-03 14:25:23 dovecot_login authenticator failed for ([127.0.0.1]) [14.195.240.154]:53008: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec  3 14:25:11 host2 pure-ftpd[2921277]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-03 14:26:55 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (cambrane) [73.137.7.97]:36882: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 14:27:41 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-12-03 14:30:32 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:51451: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-03 14:31:04 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:47472: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 118.82.8.204
country_id: 1643084
description:
[2025-12-03 14:34:57 +0530] info [cpaneld] 118.82.8.204 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec  3 14:40:03 host2 sshd[2936670]: Disconnected from invalid user developer 62.219.172.50 port 57616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 14:41:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<+EtjlwhFs+AvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec  3 14:42:44 host2 sshd[2939236]: Disconnected from invalid user huawei 62.219.172.50 port 46020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Dec  3 14:43:57 host2 sshd[2940463]: Disconnected from invalid user usuario1 62.219.172.50 port 43788 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.137.36.48
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.137.36.48 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec  3 14:46:12 host2 sshd[2943028]: Disconnected from invalid user grid 62.219.172.50 port 39460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Dec  3 14:47:15 host2 sshd[2943975]: Disconnected from invalid user kali 62.219.172.50 port 51980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 14:47:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<zDHerwhFirY+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.93
country_id: 1668284
description:
2025-12-03 14:48:09 dovecot_login authenticator failed for (ADMIN) [173.244.49.93]:6728: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 14:51:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<LgygvAhF3tE+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Dec  3 14:54:19 host2 sshd[2950558]: Disconnected from invalid user packer 23.95.37.90 port 58876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.219
country_id: 6252001
description:
Dec  3 15:01:08 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.219, lip=66.85.158.92, session=<8NRD3whFePCTuYTb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Dec  3 15:02:25 host2 sshd[2957807]: Disconnected from invalid user glenn 23.95.37.90 port 36208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Dec  3 15:03:27 host2 sshd[2959387]: Disconnected from invalid user jose 23.95.37.90 port 47304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.72
country_id: 6252001
description:
Dec  3 15:05:33 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.72, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<SxsQ7whF6dnG6xhI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 15:06:32 host2 sshd[2961759]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.15
country_id: 1522867
description:
2025-12-03 15:13:32 dovecot_login authenticator failed for (ADMIN) [62.133.47.15]:31371: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-03 15:13:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:52510: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-03 15:14:33 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:43669: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 15:16:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 39 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<O9EjFQlFXsbKm18C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 15:26:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Xk+6OQlFXrkXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Dec  3 15:29:57 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<CFdIRQlFMdq5xQmt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.43
country_id: 798544
description:
Dec  3 15:30:14 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.25.43, lip=66.85.158.91, TLS, session=<iD5mRglFf96y2Bkr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 15:31:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<KImcSwlFfoQ+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-03 15:36:37 dovecot_login authenticator failed for ([220.82.247.216]) [27.123.97.74]:49180: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-03 15:36:49 dovecot_login authenticator failed for (78-66-119-139-no600.tbcn.telia.com) [177.44.71.244]:55458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.229
country_id: 2635167
description:
2025-12-03 15:39:31 dovecot_login authenticator failed for (ADMIN) [45.133.172.229]:65477: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2025-12-03 15:43:21 dovecot_login authenticator failed for ([127.0.0.1]) [197.219.208.38]:52620: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.4
country_id: 6252001
description:
2025-12-03 15:43:28 dovecot_login authenticator failed for wsip-68-225-62-4.pn.at.cox.net ([127.0.0.1]) [68.225.62.4]:51579: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 15:48:05 host2 sshd[2991370]: Disconnected from invalid user user 2.57.121.25 port 25107 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Dec  3 15:48:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=<uMlrhglFRskpixLe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.128
country_id: 3469034
description:
Dec  3 15:48:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.72.128, lip=66.85.158.91, TLS, session=<zjfrhwlFCMG7eEiA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 15:49:44 host2 sshd[2992326]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.45
country_id: 798544
description:
Dec  3 15:52:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru>, method=PLAIN, rip=178.216.29.45, lip=66.85.158.91, TLS, session=<jtxZlAlFMYmy2B0t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 15:51:30 host2 sshd[2993803]: Disconnected from invalid user user 2.57.121.25 port 36100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.180
country_id: 798544
description:
Dec  3 15:51:44 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=178.216.25.180, lip=66.85.158.91, TLS, session=<cthGkwlFAY+y2Bm0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 15:52:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<yTVblglFVN4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 15:53:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<3HXFmwlFeLk+PIds>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 15:57:05 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 15:58:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<YkvbqglFusE+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-03 15:59:57 dovecot_plain authenticator failed for (paceatin) [5.11.140.219]:57320: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-12-03 16:00:00 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (saxammulla) [82.32.230.230]:59796: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec  3 16:02:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<DgLfuQlFEuxHBpKC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Dec  3 16:02:15 host2 dovecot[2304439]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS, session=<uWDauQlF+OpHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.139
country_id: 6252001
description:
2025-12-03 16:03:37 dovecot_login authenticator failed for (ADMIN) [181.215.182.139]:54230: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.209.123
country_id: 1819730
description:
Dec  3 16:04:55 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.209.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rFxmwwlF5puYINF7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.40
country_id: 1819730
description:
Dec  3 16:05:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.40, lip=66.85.158.92, TLS, session=<hHyxwwlFcs4tjpoo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.141
country_id: 3175395
description:
Dec  3 16:08:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.63.132.141, lip=66.85.158.91, TLS, session=<nKaN0AlFI565P4SN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.92.209.211
country_id: 614540
description:
Dec  3 16:09:12 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=188.92.209.211, lip=66.85.158.91, TLS, session=<jpmj0QlF1eO8XNHT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 16:12:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<R5dA3QlFerEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 16:13:03 host2 sshd[3013111]: Disconnected from invalid user admin 2.57.121.112 port 35887 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-03 16:15:40 dovecot_plain authenticator failed for (ragormical) [46.10.210.68]:60240: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.158
country_id: 6290252
description:
Dec  3 16:16:13 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=109.207.35.158, lip=66.85.158.91, TLS, session=<2Hpt6glFdq5tzyOe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 16:16:21 host2 sshd[3015760]: Disconnected from invalid user admin 2.57.121.112 port 41252 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.201
country_id: 3469034
description:
Dec  3 16:16:36 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=138.255.206.201, lip=66.85.158.91, TLS, session=<jQcH7AlFsaaK/87J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-03 16:20:07 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:26067: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-12-03 16:20:26 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:36650: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.109
country_id: 6252001
description:
2025-12-03 16:26:02 dovecot_login authenticator failed for (ADMIN) [181.215.182.109]:21202: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 16:26:47 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 16:28:34 host2 sshd[3026320]: Disconnected from invalid user test 2.57.121.112 port 62787 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 16:37:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<5rVMOApFLogXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 16:37:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<kQ5SOQpFurs+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 16:43:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<0k5ATApFL6tRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.177
country_id: 1880251
description:
2025-12-03 16:46:45 dovecot_login authenticator failed for (ADMIN) [156.146.57.177]:63506: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.92.201
country_id: 2802361
description:
Dec  3 16:47:57 host2 pure-ftpd[3043142]: (?@34.140.92.201) [INFO] New connection from 34.140.92.201


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.205
country_id: 6252001
description:
Dec  3 16:48:37 host2 sshd[3043701]: Disconnected from invalid user user1 166.88.160.205 port 44522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.254.165.85
country_id: 6252001
description:
Dec  3 16:49:27 host2 sshd[3044302]: Invalid user cloudtourssrilan_travel from 157.254.165.85 port 49726


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.88.160.205
country_id: 6252001
description:
Dec  3 16:54:17 host2 sshd[3048568]: Disconnected from invalid user root1 166.88.160.205 port 40066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.205
country_id: 6252001
description:
Dec  3 16:56:23 host2 sshd[3050480]: Disconnected from invalid user service 166.88.160.205 port 39508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.205
country_id: 6252001
description:
Dec  3 16:57:32 host2 sshd[3051460]: Disconnected from invalid user ghost 166.88.160.205 port 57274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 16:59:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<hZ2ThQpFBuA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 17:03:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<es/mkwpFWNw+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  3 17:05:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<bndimwpFRI2LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-03 17:07:04 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (nonchilte) [24.91.103.202]:49180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 17:07:27 host2 sshd[3060191]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-03 17:07:18 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (pulorace) [73.208.81.125]:56980: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-03 17:09:31 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:34120: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-03 17:09:56 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:43476: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec  3 17:19:23 host2 sshd[3070690]: Disconnected from invalid user lch 43.240.13.18 port 34224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-03 17:22:49 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:42220: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.217.104
country_id: 3469034
description:
Dec  3 17:23:03 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.86.217.104, lip=66.85.158.91, TLS, session=<jTG+2QpFI6qxVtlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-12-03 17:23:07 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:59796: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.4
country_id: 3469034
description:
Dec  3 17:23:23 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.168.4, lip=66.85.158.91, TLS, session=<3QDw2gpFT8KxgqgE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Dec  3 17:23:34 host2 sshd[3074031]: Disconnected from invalid user qiyuesuo 103.207.9.246 port 35250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec  3 17:24:30 host2 sshd[3074896]: Disconnected from invalid user developer 43.240.13.18 port 34412 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.207.9.246
country_id: 1269750
description:
Dec  3 17:24:49 host2 sshd[3075171]: Disconnected from invalid user webuser 103.207.9.246 port 43850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.240.13.18
country_id: 1819730
description:
Dec  3 17:26:23 host2 sshd[3076398]: Disconnected from invalid user root1 43.240.13.18 port 58024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Dec  3 17:28:30 host2 sshd[3077975]: Disconnected from invalid user testuser 103.207.9.246 port 59128 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.159
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.111.24.159 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.228
country_id: 2510769
description:
Dec  3 17:29:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.74.240.228, lip=66.85.158.91, TLS, session=<Xk4Z7wpFHui5SvDk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.94
country_id: 933860
description:
Dec  3 17:29:22 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=83.143.29.94, lip=66.85.158.91, TLS, session=<t9g/8ApFq4VTjx1e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.240.13.18
country_id: 1819730
description:
Dec  3 17:30:05 host2 sshd[3079163]: Disconnected from invalid user tester 43.240.13.18 port 58154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 17:30:32 host2 sshd[3079484]: Disconnected from invalid user admin 2.57.121.112 port 37241 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.199
country_id: 294640
description:
2025-12-03 17:37:27 dovecot_login authenticator failed for (ADMIN) [149.88.26.199]:46975: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec  3 17:40:37 host2 sshd[3087553]: Disconnected from invalid user usuario2 23.95.128.167 port 36482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec  3 17:41:50 host2 sshd[3088640]: Disconnected from invalid user amssys 23.95.128.167 port 40326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.128.167
country_id: 6252001
description:
Dec  3 17:43:01 host2 sshd[3089491]: Disconnected from invalid user debianuser 23.95.128.167 port 42626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec  3 17:44:08 host2 sshd[3090676]: Disconnected from invalid user ubuntu 23.95.128.167 port 47078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 17:45:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</1YcKwtFzoU+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec  3 17:50:25 host2 sshd[3096321]: Disconnected from invalid user ts2 152.32.171.99 port 49036 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 17:51:02 host2 sshd[3096930]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec  3 17:53:20 host2 sshd[3099232]: Disconnected from invalid user developer 152.32.171.99 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec  3 17:54:23 host2 sshd[3100192]: Disconnected from invalid user bodega 103.186.0.68 port 37944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec  3 17:54:38 host2 sshd[3100575]: Disconnected from invalid user ubuntu 152.32.171.99 port 38378 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Dec  3 17:55:35 host2 sshd[3101391]: Disconnected from invalid user ubuntu 103.186.0.68 port 45444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Dec  3 17:56:20 host2 sshd[3102329]: Disconnected from invalid user opc 36.95.221.140 port 60228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Dec  3 17:56:23 host2 sshd[3102367]: Disconnected from invalid user supermaint 45.249.246.88 port 20424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Dec  3 17:56:49 host2 sshd[3102821]: Disconnected from invalid user tester 103.186.0.68 port 40066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec  3 17:55:52 host2 sshd[3101733]: Disconnected from invalid user student 152.32.171.99 port 33714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec  3 17:57:06 host2 sshd[3103085]: Disconnected from invalid user autrede 152.32.171.99 port 57832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 17:57:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<xBFBVwtFGK5RvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Dec  3 17:59:31 host2 sshd[3105413]: Disconnected from invalid user ftpuser 45.249.246.88 port 15910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.246.88
country_id: 1819730
description:
Dec  3 18:00:56 host2 sshd[3106703]: Disconnected from invalid user saas 45.249.246.88 port 45304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Dec  3 18:01:45 host2 sshd[3107229]: Disconnected from invalid user intell 36.95.221.140 port 36898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec  3 18:02:30 host2 sshd[3107700]: Disconnected from invalid user opc 35.188.112.111 port 59672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Dec  3 18:03:26 host2 sshd[3108646]: Disconnected from invalid user sopuser 45.249.246.88 port 49084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.188.112.111
country_id: 6252001
description:
Dec  3 18:03:30 host2 sshd[3108679]: Disconnected from invalid user astra 35.188.112.111 port 52744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.188.112.111
country_id: 6252001
description:
Dec  3 18:04:30 host2 sshd[3109342]: Disconnected from invalid user work 35.188.112.111 port 55052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.56.80.8
country_id: 6251999
description:
Dec  3 18:04:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=66.56.80.8, lip=66.85.158.91, session=<9F+QbwtFgBBCOFAI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 18:05:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<gVjecAtFDMw+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Dec  3 18:05:40 host2 sshd[3110521]: Disconnected from invalid user pzuser 36.95.221.140 port 44730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.17
country_id: 3042225
description:
2025-12-03 18:06:34 dovecot_login authenticator failed for (ADMIN) [91.90.124.17]:29775: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Dec  3 18:05:52 host2 sshd[3110665]: Disconnected from invalid user ubuntu 45.249.246.88 port 52866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 18:08:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<BvNnfgtF7MY+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 18:15:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56203: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.153
country_id: 953987
description:
Dec  3 18:16:31 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.64.47.153, lip=66.85.158.91, TLS, session=<AB6hmAtFjapmQC+Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.143.116
country_id: 2963597
description:
Dec  3 18:16:48 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=89.106.143.116, lip=66.85.158.91, TLS, session=<SfwXmgtFKotZao90>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.242
country_id: 953987
description:
Dec  3 18:18:11 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.129.52.242, lip=66.85.158.91, TLS, session=<2N3MngtFGY9mgTTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.79
country_id: 3469034
description:
Dec  3 18:18:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.248.79, lip=66.85.158.91, TLS, session=<QDWxoAtFZNC60fhP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  3 18:19:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+6cZpgtFlnFChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.210.233
country_id: 2921044
description:
Dec  3 18:21:07 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.210.233, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<XuJ6qgtFP2+kWtLp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.171.56
country_id: 2921044
description:
Dec  3 18:21:42 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=142.93.171.56, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zSiXrAtFCsuOXas4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-03 18:24:47 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (unmacke) [71.230.228.16]:58396: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-03 18:25:46 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40672: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-03 18:25:23 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:52012: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.225.54
country_id: 2921044
description:
Dec  3 18:26:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=46.101.225.54, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hBffvAtFjnIuZeE2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.168.197
country_id: 2750405
description:
2025-12-03 18:28:55 dovecot_login authenticator failed for (ADMIN) [191.96.168.197]:21324: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 18:29:12 host2 sshd[3131696]: Disconnected from invalid user user 2.57.121.25 port 29356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.200.147.177
country_id: 2661886
description:
2025-12-03 18:31:41 dovecot_plain authenticator failed for c213-200-147-177.bredband.tele2.se (CUF28CYXYG583UI9) [213.200.147.177]:58296: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-03 18:34:01 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (vottious) [73.88.196.91]:33626: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.135
country_id: 3469034
description:
Dec  3 18:37:21 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=186.209.250.135, lip=66.85.158.91, TLS, session=<xftb4wtFyI+60fqH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.210
country_id: 953987
description:
Dec  3 18:37:43 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.46.210, lip=66.85.158.91, TLS, session=<sKC15AtFHNxmQC7S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 18:38:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Vh8g6QtFIztRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec  3 18:40:37 host2 sshd[3141149]: Disconnected from invalid user update 103.106.194.74 port 60540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec  3 18:43:31 host2 sshd[3143405]: Disconnected from invalid user apache 103.106.194.74 port 46112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Dec  3 18:46:21 host2 sshd[3145699]: Disconnected from invalid user halo 103.106.194.74 port 43102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec  3 18:49:05 host2 sshd[3148052]: Disconnected from invalid user ts3 103.106.194.74 port 40084 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 18:49:14 +0530] info [cpaneld] 43.245.222.27 - yashih "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashih (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-12-03 18:52:21 +0530] info [cpaneld] 149.30.139.241 - cpsess4340482927frontendpaper_lanternfilemanagerindex.html "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.35
country_id: 6252001
description:
2025-12-03 18:52:37 dovecot_login authenticator failed for (ADMIN) [212.32.50.35]:42282: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 18:52:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<din8GwxF7Io+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec  3 18:55:55 host2 sshd[3153782]: Disconnected from invalid user gns3 118.26.36.241 port 48502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.227.46
country_id: 1880251
description:
Dec  3 18:56:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=15.235.227.46, lip=66.85.158.92, session=<l6aRKAxFUM8P6+Mu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.68.51
country_id: 2921044
description:
Dec  3 18:57:29 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.68.51, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<XpaGLAxFz7WhI0Qz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.117.167
country_id: 2921044
description:
Dec  3 18:58:04 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.117.167, lip=66.85.158.91, TLS handshaking: Connection closed, session=<84SjLgxF1OSd5nWn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.70
country_id: 6252001
description:
Dec  3 18:58:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3WWoMAxF5NhiUARG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec  3 19:00:08 host2 sshd[3156855]: Disconnected from invalid user azureuser 118.26.36.241 port 50778 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.19
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.19: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-03 19:02:12 dovecot_plain authenticator failed for (fragraper) [2.55.125.200]:34438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-03 19:02:16 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (crous) [174.166.153.20]:46032: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.36.241
country_id: 1819730
description:
Dec  3 19:02:40 host2 sshd[3158544]: Disconnected from invalid user sopuser 118.26.36.241 port 57594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 19:03:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</UjkQQxFpN0XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec  3 19:04:21 host2 sshd[3160420]: Disconnected from invalid user kali 118.26.36.241 port 59826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Dec  3 19:05:39 host2 sshd[3161511]: Disconnected from invalid user ahmed 118.26.36.241 port 43130 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 19:09:14 host2 sshd[3164089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 19:09:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<DxPtWAxF1JE+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.3.154.37
country_id: 6252001
description:
Dec  3 19:17:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.3.154.37, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9g45cwxFvNPAA5ol>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.0.20
country_id: 2750405
description:
Dec  3 19:19:09 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.0.20, lip=66.85.158.92, session=<X98KegxFyN+f3wAU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.84.178
country_id: 3017382
description:
Dec  3 19:19:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.134.84.178, lip=66.85.158.91, TLS: Connection closed, session=<cDyffAxFc4RbhlSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.45
country_id: 3865483
description:
2025-12-03 19:21:08 dovecot_login authenticator failed for (ADMIN) [146.70.38.45]:6567: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.3.154.37
country_id: 6252001
description:
Dec  3 19:27:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.3.154.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<C1CWlwxFNK/AA5ol>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 19:29:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ban4nQxFZOUXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 19:34:18 host2 sshd[3185577]: Disconnected from invalid user vanesa 62.60.131.157 port 61756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec  3 19:39:52 host2 sshd[3190221]: Disconnected from invalid user elk 189.50.142.82 port 49253 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-03 19:43:25 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:58410: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-03 19:43:38 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:52520: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 19:44:24 host2 sshd[3194257]: Disconnected from invalid user user 2.57.121.25 port 35268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.71
country_id: 783754
description:
2025-12-03 19:46:55 dovecot_login authenticator failed for (ADMIN) [31.171.154.71]:35318: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 19:47:45 host2 sshd[3197308]: Disconnected from invalid user user 2.57.121.25 port 36231 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Dec  3 19:50:45 host2 sshd[3199973]: Disconnected from invalid user ubuntu 45.78.197.91 port 59444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec  3 19:51:30 host2 sshd[3200721]: Disconnected from invalid user media 189.50.142.82 port 35207 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 19:53:19 host2 sshd[3202818]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec  3 19:54:44 host2 sshd[3204338]: Disconnected from invalid user opc 189.50.142.82 port 56619 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Dec  3 19:57:43 host2 sshd[3207176]: Disconnected from invalid user ubuntu 45.78.197.91 port 46958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-03 19:59:01 dovecot_login authenticator failed for (2NPo16) [178.16.54.97]:60174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 19:59:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<HQ/XCw1FEJc+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-03 20:00:13 dovecot_login authenticator failed for (MFB6uaN7) [178.16.54.97]:59269: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-03 20:01:19 dovecot_login authenticator failed for (VpieCdM) [178.16.54.97]:56774: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec  3 20:03:51 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<H7bnGQ1FNttChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.91
country_id: 1880251
description:
Dec  3 20:04:39 host2 sshd[3212791]: Disconnected from invalid user saas 45.78.197.91 port 37862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.6.132
country_id: 2395170
description:
Dec  3 20:04:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=41.74.6.132, lip=66.85.158.91, TLS, session=<rg92HA1FibUpSgaE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.108
country_id: 3469034
description:
Dec  3 20:05:13 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.154.227.108, lip=66.85.158.91, TLS, session=<7vilHQ1Fft2xmuNs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.197.91
country_id: 1880251
description:
Dec  3 20:06:58 host2 sshd[3214666]: Disconnected from invalid user test1 45.78.197.91 port 49866 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 20:07:08 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 20:15:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<a6a1QQ1FDr8+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.233
country_id: 1269750
description:
Dec  3 20:17:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.70.126.233, lip=66.85.158.91, TLS, session=<w1WmRw1FnohnRn7p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.195
country_id: 798544
description:
Dec  3 20:17:22 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=91.231.121.195, lip=66.85.158.91, TLS, session=<BzAKSQ1FupVb53nD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 20:21:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<ssZaWA1F6pg+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-03 20:26:11 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (ancerabar) [67.173.58.47]:40964: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  3 20:29:27 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uVN4dQ1FNF24affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.36
country_id: 6252001
description:
Dec  3 20:30:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z6+fdw1F+VNAPpwk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec  3 20:30:05 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.92, TLS: Connection closed, session=<yuO6dw1FCCy4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec  3 20:30:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YMnIeA1FUtZAPpwY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.64
country_id: 2635167
description:
Dec  3 20:39:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.64, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<uTDimA1FtcAjy9NA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.64
country_id: 2635167
description:
Dec  3 20:40:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.64, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<TMXOnA1Fvv4jy9NA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.170
country_id: 6252001
description:
Dec  3 20:44:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.117.170, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pa+6qg1F1MmsynWq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.219
country_id: 3175395
description:
2025-12-03 20:44:15 dovecot_login authenticator failed for (ADMIN) [156.146.41.219]:52810: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.57.26
country_id: 6252001
description:
Dec  3 20:45:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.221.57.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Uxi2rw1FRr8U3Tka>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.194.88.223
country_id: 357994
description:
2025-12-03 20:46:35 dovecot_plain authenticator failed for (ZZ7H17CIG) [156.194.88.223]:4761: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-12-03 20:47:12 dovecot_login authenticator failed for (60-249-252-94.hinet-ip.hinet.net) [128.185.227.142]:43498: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-03 20:47:25 dovecot_login authenticator failed for ([222.76.248.54]) [82.193.122.91]:52031: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 20:48:10 host2 sshd[3250517]: Disconnected from invalid user  2.57.121.112 port 63077 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.64
country_id: 2635167
description:
Dec  3 20:47:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.64, lip=66.85.158.91, TLS, session=<AEROtw1F9PQjy9NA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 20:49:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<BEFxuw1F2NMXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec  3 20:57:27 host2 sshd[3258849]: Disconnected from invalid user valheim 103.52.115.25 port 52500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec  3 20:59:20 host2 sshd[3260703]: Disconnected from invalid user dd 70.54.182.130 port 52220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Dec  3 21:00:24 host2 sshd[3261664]: Disconnected from invalid user deploy 103.52.115.25 port 48372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec  3 21:03:24 host2 sshd[3264704]: Disconnected from invalid user sales1 70.54.182.130 port 52383 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Dec  3 21:03:11 host2 sshd[3264405]: Disconnected from invalid user syncuser 103.52.115.25 port 51930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.214
country_id: 6252001
description:
Dec  3 21:04:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MJIM8Q1F/VxAPpzW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec  3 21:04:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EMEa8g1F8MtAPpzU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec  3 21:06:27 host2 sshd[3267473]: Disconnected from invalid user vncuser 70.54.182.130 port 59769 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  3 21:06:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<04DB+Q1FguCSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 21:06:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<aL0k+w1Fgok+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec  3 21:06:56 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<aP58+w1FwoSnXpI8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.108
country_id: 6252001
description:
2025-12-03 21:10:30 dovecot_login authenticator failed for wsip-184-191-250-108.fv.ks.cox.net ([127.0.0.1]) [184.191.250.108]:40287: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-03 21:10:43 dovecot_login authenticator failed for ([127.0.0.1]) [117.250.19.91]:32872: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 21:11:32 host2 sshd[3272001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.172
country_id: 2635167
description:
2025-12-03 21:12:41 dovecot_login authenticator failed for (ADMIN) [158.173.23.172]:28955: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 21:16:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<5CVjHA5F7sIXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.8.169
country_id: 2750405
description:
Dec  3 21:17:32 host2 sshd[3276798]: Disconnected from invalid user ts2 174.138.8.169 port 46128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec  3 21:18:26 host2 sshd[3277538]: Disconnected from invalid user rstudio 162.241.87.197 port 54440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.138.8.169
country_id: 2750405
description:
Dec  3 21:19:36 host2 sshd[3278243]: Disconnected from invalid user rstudio 174.138.8.169 port 43190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec  3 21:19:37 host2 sshd[3278274]: Disconnected from invalid user a 162.241.87.197 port 60918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.8.169
country_id: 2750405
description:
Dec  3 21:20:32 host2 sshd[3279226]: Disconnected from invalid user a 174.138.8.169 port 49638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-03 21:20:42 dovecot_login authenticator failed for ([103.115.252.60]) [140.84.188.140]:50936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Dec  3 21:20:45 host2 sshd[3279386]: Disconnected from invalid user testadmin 162.241.87.197 port 43370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  3 21:20:53 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<AX9cLQ5FtOaLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 21:20:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<nklrKw5Fyqc+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Dec  3 21:21:49 host2 sshd[3280128]: Disconnected from invalid user developer 162.241.87.197 port 35428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.8.169
country_id: 2750405
description:
Dec  3 21:22:27 host2 sshd[3280535]: Disconnected from invalid user github 174.138.8.169 port 51732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Dec  3 21:24:19 host2 sshd[3281823]: Disconnected from invalid user castle 159.223.183.233 port 36442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:24:24 host2 sshd[3281865]: Disconnected from invalid user debianuser 34.39.58.191 port 34592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 21:23:53 host2 sshd[3281423]: Disconnected from invalid user admin 2.57.121.112 port 44455 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Dec  3 21:25:27 host2 sshd[3282721]: Disconnected from invalid user ubuntu 159.223.183.233 port 55562 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-03 21:25:44 dovecot_login authenticator failed for ([70.166.167.48]) [37.25.36.197]:49375: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-03 21:25:27 dovecot_login authenticator failed for ([59.145.84.25]) [103.109.13.50]:34994: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec  3 21:26:00 host2 sshd[3283229]: Disconnected from invalid user old 125.31.2.160 port 42840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.183.233
country_id: 6252001
description:
Dec  3 21:26:27 host2 sshd[3283522]: Disconnected from invalid user tidb 159.223.183.233 port 40462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 21:27:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<irNMRA5F8I0+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:27:52 host2 sshd[3284663]: Disconnected from invalid user django 34.39.58.191 port 52554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-03 21:27:14 dovecot_plain authenticator failed for (chror) [102.53.15.56]:60835: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec  3 21:28:36 host2 sshd[3285260]: Disconnected from invalid user manager 125.31.2.160 port 55362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Dec  3 21:28:25 host2 sshd[3285087]: Disconnected from invalid user student 159.223.183.233 port 43664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:28:57 host2 sshd[3285526]: Disconnected from invalid user nishant 34.39.58.191 port 36446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-03 21:29:47 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (prilize) [73.195.211.98]:39526: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec  3 21:29:55 host2 sshd[3286331]: Disconnected from invalid user username 125.31.2.160 port 53890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Dec  3 21:31:11 host2 sshd[3287683]: Disconnected from invalid user laravel 125.31.2.160 port 52414 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-03 21:31:43 dovecot_plain authenticator failed for (astier) [64.72.74.162]:58899: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:32:05 host2 sshd[3288551]: Disconnected from invalid user backend 34.39.58.191 port 57856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec  3 21:32:24 host2 sshd[3288990]: Disconnected from invalid user vncuser 125.31.2.160 port 50926 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.227
country_id: 6252001
description:
Dec  3 21:33:05 host2 pure-ftpd[3290160]: (?@198.235.24.227) [INFO] New connection from 198.235.24.227


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:36:01 host2 sshd[3292984]: Disconnected from invalid user dangulo 34.39.58.191 port 56240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:37:02 host2 sshd[3293965]: Disconnected from invalid user teste 34.39.58.191 port 60582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:38:05 host2 sshd[3294906]: Disconnected from invalid user laravel 34.39.58.191 port 49764 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec  3 21:39:04 host2 sshd[3295674]: Disconnected from invalid user manager 34.39.58.191 port 44652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.57
country_id: 798544
description:
2025-12-03 21:43:06 dovecot_login authenticator failed for (ADMIN) [138.199.59.57]:44388: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.158
country_id: 953987
description:
Dec  3 21:46:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.129.61.158, lip=66.85.158.91, TLS, session=</PwdiQ5FcbJmgT2e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.130
country_id: 798544
description:
Dec  3 21:47:11 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.98.130, lip=66.85.158.91, TLS, session=<Bf9nig5Fi76y22KC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 21:55:04 host2 sshd[3322228]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-03 21:56:30 dovecot_plain authenticator failed for (amete) [149.62.239.4]:39560: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.156
country_id: 6252001
description:
Dec  3 22:00:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.156, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qVTKuw5FdLMs3Lmc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  3 22:02:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<Bg3mwg5F+sCLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.80.94
country_id: 3469034
description:
Dec  3 22:04:33 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.106.80.94, lip=66.85.158.91, TLS, session=<y5ZnyA5FN9mzalBe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.33.198
country_id: 226074
description:
Dec  3 22:04:55 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.33.198, lip=66.85.158.91, TLS, session=<Bg6syQ5FiNzEACHG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.9
country_id: 289688
description:
2025-12-03 22:10:53 dovecot_login authenticator failed for (ADMIN) [95.181.234.9]:24245: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 22:11:48 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 22:13:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<KAZk6g5FipM+PIdr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.123
country_id: 6252001
description:
Dec  3 22:13:40 host2 pure-ftpd[3337374]: (?@20.118.209.123) [INFO] New connection from 20.118.209.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 22:16:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54242: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  3 22:17:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<KrmN9w5FFMiSOC+J>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.136
country_id: 6252001
description:
Dec  3 22:18:06 host2 pure-ftpd[3340769]: (?@198.235.24.136) [INFO] New connection from 198.235.24.136


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.49
country_id: 6252001
description:
Dec  3 22:18:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.49, lip=66.85.158.91, session=<1tyr+g5FYz9BMQEx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Dec  3 22:18:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.38, lip=66.85.158.91, TLS: Connection closed, session=<gEZ9+w5FaidBMQEm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.226.107.87
country_id: 6252001
description:
Dec  3 22:21:51 host2 pure-ftpd[3343848]: (?@54.226.107.87) [INFO] New connection from 54.226.107.87


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 22:22:42 host2 sshd[3344443]: Disconnected from invalid user user 2.57.121.25 port 48578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 22:27:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<h3XFGw9FJOk+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Dec  3 22:28:48 host2 sshd[3349327]: Disconnected from invalid user john 101.47.143.205 port 54204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.242.134
country_id: 798544
description:
Dec  3 22:29:21 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=109.125.242.134, lip=66.85.158.91, TLS, session=<9gc5IQ9FmqxtffKG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.68
country_id: 3175395
description:
Dec  3 22:29:39 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=217.26.179.68, lip=66.85.158.91, TLS, session=<6YBZIg9FmazZGrNE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Dec  3 22:31:23 host2 sshd[3351407]: Disconnected from invalid user ubuntu 101.47.143.205 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.205
country_id: 1880251
description:
Dec  3 22:33:56 host2 sshd[3352944]: Disconnected from invalid user user2 101.47.143.205 port 49012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 22:34:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<0HIlNA9FyoE+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 22:35:47 host2 sshd[3354496]: Disconnected from invalid user savion 62.60.131.157 port 64263 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.48
country_id: 6252001
description:
2025-12-03 22:42:59 dovecot_login authenticator failed for (ADMIN) [191.96.37.48]:12667: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.19.234.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.19.234.53 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-03 22:46:04 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (cracia) [174.166.153.20]:59834: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Dec  3 22:58:19 host2 sshd[3372105]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 60538


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.19
country_id: 2635167
description:
Dec  3 23:00:41 host2 dovecot[2304439]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.19, lip=66.85.158.91, TLS, session=<kQJLkg9F/5q594kT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.69
country_id: 2635167
description:
Dec  3 23:00:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.69, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kSpnkg9FXYFX7LBF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec  3 23:01:08 host2 sshd[3374395]: Disconnected from invalid user halo 194.107.115.2 port 47014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.71
country_id: 2635167
description:
Dec  3 23:01:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.71, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eZ5ilA9FG7a594lH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.45
country_id: 2635167
description:
Dec  3 23:02:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.45, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<fUdZmA9FGYxX7LAt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.65
country_id: 2635167
description:
Dec  3 23:03:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.65, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+gNOnA9F171X7LBB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  3 23:03:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<oFCNnQ9F+oWSOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.54
country_id: 2635167
description:
Dec  3 23:02:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.54, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<n6VUmg9Fca+594k2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.228.225.239
country_id: 2658434
description:
2025-12-03 23:02:58 dovecot_login authenticator failed for (83.228.225.239) [83.228.225.239]:64514: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 23:04:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<kGfWnw9FLiZRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.54
country_id: 2635167
description:
Dec  3 23:04:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.54, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5d9GoA9FTc2594k2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.62
country_id: 2635167
description:
Dec  3 23:04:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YllLng9FX5u594k+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Dec  3 23:04:21 host2 sshd[3377193]: Disconnected from invalid user apache 194.107.115.2 port 52874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.48
country_id: 2635167
description:
Dec  3 23:05:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<nOJBog9Fb79X7LAw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.53
country_id: 2635167
description:
Dec  3 23:05:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<QTo9pA9Fl9hX7LA1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec  3 23:08:10 host2 sshd[3380018]: Disconnected from invalid user administrator 194.107.115.2 port 20944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec  3 23:09:20 host2 sshd[3380812]: Disconnected from invalid user ts3 194.107.115.2 port 47944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.216
country_id: 6252001
description:
Dec  3 23:11:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.216, lip=66.85.158.92, session=<sheZuQ9Fj31APpzY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec  3 23:11:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS: Connection closed, session=<5RxTug9F+PtAPpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec  3 23:12:06 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, session=<44kmuw9FCOFAPpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.184
country_id: 2635167
description:
Dec  3 23:13:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.210.184, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<GX5vvw9FXNEjy9K4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.220
country_id: 3469034
description:
Dec  3 23:14:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=190.89.137.220, lip=66.85.158.91, TLS, session=<0AHXwA9Frs++WYnc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.184
country_id: 2635167
description:
Dec  3 23:14:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.210.184, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Jo1Vww9FpvYjy9K4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.21
country_id: 953987
description:
Dec  3 23:14:23 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.42.21, lip=66.85.158.91, TLS, session=<8RMuwg9FD9RmQCoV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.184
country_id: 2635167
description:
Dec  3 23:15:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.210.184, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<mkguxg9F/PUjy9K4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.69
country_id: 6252001
description:
2025-12-03 23:16:27 dovecot_login authenticator failed for (ADMIN) [37.19.198.69]:53765: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  3 23:16:59 host2 pure-ftpd[3386139]: (?@64.62.156.222) [INFO] New connection from 64.62.156.222


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 23:21:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<zWOd2w9FIuo+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-03 23:22:11 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (impes) [174.59.253.88]:41448: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.184
country_id: 2635167
description:
Dec  3 23:22:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.184, lip=66.85.158.92, TLS, session=<81SE4Q9FKuwjy9K4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.184
country_id: 2635167
description:
Dec  3 23:23:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.184, lip=66.85.158.92, TLS, session=<hzld5Q9F+OQjy9K4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-03 23:31:50 dovecot_login authenticator failed for ([127.0.0.1]) [182.79.87.18]:58446: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.21
country_id: 6252001
description:
2025-12-03 23:31:57 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.44.21]:36196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 23:33:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<4uUNBhBFppw+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 23:35:32 host2 sshd[3400702]: Disconnected from invalid user user 2.57.121.25 port 25518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.187.226.138
country_id: 1269750
description:
2025-12-03 23:36:08 dovecot_login authenticator failed for (106-226-187-203.static.youbroadband.in) [203.187.226.138]:41442: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-03 23:36:37 dovecot_login authenticator failed for ([90.160.139.163]) [90.160.139.163]:43058: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 23:38:55 host2 sshd[3403051]: Disconnected from invalid user user 2.57.121.25 port 5409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 23:40:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<x9eKIBBFRoA+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec  3 23:46:22 host2 sshd[3409926]: Disconnected from invalid user ts3 106.51.1.63 port 43724 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Dec  3 23:47:34 host2 sshd[3410758]: Disconnected from invalid user sammy 106.51.1.63 port 42128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec  3 23:48:46 host2 sshd[3411769]: Disconnected from invalid user elemental 106.51.1.63 port 40548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-03 23:48:35 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:34162: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 23:50:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<U86MQhBFrozKm18C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 23:50:54 host2 sshd[3413482]: Disconnected from invalid user admin 2.57.121.112 port 35206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.134.174.197
country_id: 1814991
description:
Dec  3 23:51:08 host2 sshd[3413710]: Disconnected from invalid user ts2 8.134.174.197 port 37780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.39
country_id: 6252001
description:
Dec  4 00:00:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DyXfaBBF+diTuYQn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.252
country_id: 6252001
description:
Dec  4 00:01:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iTOpaxBFfsGTuYT8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Dec  4 00:04:55 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.202, lip=66.85.158.92, session=<dtcDeBBFPNas7OTK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Dec  4 00:04:56 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=45.79.181.94, lip=66.85.158.91, session=<1+oNeBBFgnctT7Ve>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 00:06:04 host2 sshd[3426035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.140.123.15
country_id: 6290252
description:
Dec  4 00:06:22 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=95.140.123.15, lip=66.85.158.91, TLS, session=<rSoxfBBFf+RfjHsP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.105.214.48
country_id: 3865483
description:
Dec  4 00:06:43 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.105.214.48, lip=66.85.158.91, TLS, session=<pvRWfRBFaqO+adYw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-12-04 00:09:32 +0530] info [cpaneld] 149.30.139.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.239
country_id: 3469034
description:
Dec  4 00:12:31 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=187.120.76.239, lip=66.85.158.91, TLS, session=<dkT6kRBFXK27eEzv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.6
country_id: 798544
description:
Dec  4 00:12:48 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.125.4.6, lip=66.85.158.91, TLS, session=<KBM6kxBFtZi5fQQG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  4 00:11:59 host2 sshd[3431004]: Disconnected from invalid user vernon 62.60.131.157 port 13585 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.226.152
country_id: 6252001
description:
2025-12-04 00:20:44 dovecot_login authenticator failed for (ADMIN) [173.239.226.152]:57375: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.195
country_id: 6252001
description:
Dec  4 00:21:58 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.195, lip=66.85.158.92, session=<4IABtRBF2O7N0h/D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 00:29:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<iyMD0RBFBIU+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-04 00:38:34 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ineal) [87.103.126.54]:41552: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 00:38:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<6Xtz8RBFaK8+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Dec  4 00:40:05 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.76, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7JHA9RBFlc6TuYRM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 00:46:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<JsF4DRFFsMQ+PIdo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 00:48:59 host2 sshd[3457731]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  4 00:51:40 host2 sshd[3459774]: Disconnected from invalid user user 2.57.121.25 port 13573 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-04 00:52:16 dovecot_login authenticator failed for ([127.0.0.1]) [122.186.202.106]:36770: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-04 00:51:58 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.226.163]:45470: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.78
country_id: 298795
description:
2025-12-04 00:58:00 dovecot_login authenticator failed for (ADMIN) [188.213.34.78]:37875: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.53
country_id: 3175395
description:
Dec  4 01:02:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=195.177.113.53, lip=66.85.158.91, TLS, session=<LoSeRRFFj5PDsXE1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.5.56.210
country_id: 1210997
description:
Dec  4 01:03:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=202.5.56.210, lip=66.85.158.91, TLS, session=<fe/CRhFFnOvKBTjS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  4 01:05:05 host2 sshd[3470813]: Disconnected from invalid user admin 2.57.121.112 port 33349 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.12.122
country_id: 6252001
description:
Dec  4 01:04:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.33.12.122, lip=66.85.158.91, session=<RgXEThFFQoQtIQx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.169.138
country_id: 2921044
description:
Dec  4 01:06:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.169.138, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<UGJdUxFFu0ynrKmK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.101.182
country_id: 2921044
description:
Dec  4 01:06:50 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.101.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7m13VRFFUHud5mW2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 4.149.235.161
country_id: 6252001
description:
Dec  4 01:06:53 host2 pure-ftpd[3472002]: (?@4.149.235.161) [INFO] New connection from 4.149.235.161


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  4 01:09:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<2im8XxFFzsmSOC+J>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.53.179.132
country_id: 6252001
description:
Dec  4 01:13:23 host2 pure-ftpd[3476214]: (?@52.53.179.132) [INFO] New connection from 52.53.179.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.115.51
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.68.115.51 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec  4 01:29:48 host2 sshd[3487409]: Disconnected from invalid user liyang 209.15.115.240 port 46946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Dec  4 01:30:08 host2 sshd[3487792]: Disconnected from invalid user azureuser 139.59.231.45 port 55442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Dec  4 01:31:30 host2 sshd[3488762]: Disconnected from invalid user postgres 195.158.4.216 port 54492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec  4 01:34:48 host2 sshd[3490704]: Disconnected from invalid user temp 209.15.115.240 port 52106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Dec  4 01:34:04 host2 sshd[3490246]: Disconnected from invalid user asterisk 195.158.4.216 port 55036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Dec  4 01:35:17 host2 sshd[3491182]: Disconnected from invalid user debian 195.158.4.216 port 44412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Dec  4 01:35:43 host2 sshd[3491462]: Disconnected from invalid user testuser 152.32.185.214 port 38140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.231.45
country_id: 1880251
description:
Dec  4 01:34:57 host2 sshd[3490767]: Disconnected from invalid user vendas 139.59.231.45 port 46360 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Dec  4 01:35:51 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8x85vRFFxteTuYTw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Dec  4 01:36:32 host2 sshd[3491937]: Disconnected from invalid user guest123 195.158.4.216 port 35608 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  4 01:36:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<3YGrvxFFTPVRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Dec  4 01:36:52 host2 sshd[3492116]: Disconnected from invalid user hadoop 152.32.185.214 port 48500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Dec  4 01:37:29 host2 sshd[3492492]: Disconnected from invalid user gg 139.59.231.45 port 34620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.185.214
country_id: 1819730
description:
Dec  4 01:38:02 host2 sshd[3492790]: Disconnected from invalid user intell 152.32.185.214 port 48584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 01:38:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<hf43xhFFhNM+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Dec  4 01:39:14 host2 sshd[3493721]: Disconnected from invalid user testadmin 152.32.185.214 port 41556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec  4 01:38:52 host2 sshd[3493289]: Disconnected from invalid user user 209.15.115.240 port 35240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Dec  4 01:38:56 host2 sshd[3493306]: Disconnected from invalid user vagrant 195.158.4.216 port 48850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Dec  4 01:40:14 host2 sshd[3494365]: Disconnected from invalid user testuser 209.15.115.240 port 38104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.115.240
country_id: 1605651
description:
Dec  4 01:41:32 host2 sshd[3495042]: Disconnected from invalid user teamspeak 209.15.115.240 port 44560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 01:44:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<gYPe3BFF3IU+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Dec  4 01:49:45 host2 sshd[3500905]: Disconnected from invalid user local 154.221.28.214 port 49716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 01:52:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<fTGQ+RFFRKw+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Dec  4 01:53:53 host2 sshd[3504181]: Disconnected from invalid user user 154.221.28.214 port 41224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Dec  4 01:54:27 host2 sshd[3504879]: Disconnected from invalid user local 103.248.120.6 port 52785 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.7.21.152
country_id: 3508796
description:
Dec  4 01:54:33 host2 sshd[3505007]: Disconnected from invalid user steam 186.7.21.152 port 37549 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Dec  4 01:55:28 host2 sshd[3505933]: Disconnected from invalid user dspace 154.221.28.214 port 40492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec  4 01:55:58 host2 sshd[3506486]: Disconnected from invalid user userroot 156.236.75.64 port 48722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec  4 01:57:10 host2 sshd[3507171]: Disconnected from invalid user user 156.236.75.64 port 41450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.64
country_id: 1819730
description:
Dec  4 01:58:21 host2 sshd[3507899]: Disconnected from invalid user dev 156.236.75.64 port 34556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Dec  4 01:58:31 host2 sshd[3508020]: Disconnected from invalid user under 154.221.28.214 port 50440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec  4 01:59:31 host2 sshd[3508878]: Disconnected from invalid user odoo 156.236.75.64 port 42424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.7.21.152
country_id: 3508796
description:
Dec  4 02:01:18 host2 sshd[3510239]: Disconnected from invalid user ftpadmin 186.7.21.152 port 54217 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.110
country_id: 6252001
description:
Dec  4 02:03:09 host2 pure-ftpd[3511409]: (?@45.79.207.110) [INFO] New connection from 45.79.207.110


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.7.21.152
country_id: 3508796
description:
Dec  4 02:03:26 host2 sshd[3511657]: Disconnected from invalid user elastic 186.7.21.152 port 59115 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.248.120.6
country_id: 1269750
description:
Dec  4 02:04:58 host2 sshd[3512357]: Disconnected from invalid user sahil 103.248.120.6 port 48210 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 02:05:56 host2 sshd[3513035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Dec  4 02:07:20 host2 sshd[3513962]: Disconnected from invalid user jacob 103.248.120.6 port 54259 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-04 02:07:33 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:18333: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  4 02:07:43 host2 sshd[3514195]: Disconnected from invalid user user 2.57.121.25 port 29599 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.7.21.152
country_id: 3508796
description:
Dec  4 02:07:46 host2 sshd[3514226]: Disconnected from invalid user x 186.7.21.152 port 41268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-12-04 02:06:58 dovecot_login authenticator failed for ([125.23.202.194]) [125.23.202.194]:37706: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  4 02:08:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<qSexMxJFHuGl4z73>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.147
country_id: 6252001
description:
2025-12-04 02:09:43 dovecot_login authenticator failed for (ADMIN) [191.96.37.147]:18957: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 02:10:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1zW9ORJFnN0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-04 02:22:41 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:36149: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-04 02:22:14 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:35924: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.39.45
country_id: 1819730
description:
Dec  4 02:28:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.193.39.45, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8g5lehJF3Bd2wSct>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.247.76.193
country_id: 3865483
description:
Dec  4 02:29:22 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=170.247.76.193, lip=66.85.158.91, TLS, session=<3k56exJFZp+q90zB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.126
country_id: 953987
description:
Dec  4 02:29:44 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.35.126, lip=66.85.158.91, TLS, session=<9vi9fBJFGK9mQCN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-04 02:29:55 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49249: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-04 02:31:28 +0530] info [cpaneld] 89.249.55.106 - agentall "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agentall (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 02:47:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<pru8uxJFEKM+PIdr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 02:48:47 host2 sshd[3544710]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.198
country_id: 3469034
description:
2025-12-04 02:48:07 dovecot_login authenticator failed for (ADMIN) [188.241.177.198]:5813: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Dec  4 02:50:30 host2 pure-ftpd[3545987]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.43.66.5
country_id: 798544
description:
Dec  4 02:51:34 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=195.43.66.5, lip=66.85.158.91, TLS, session=<5SAHyxJFwrDDK0IF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 02:50:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<QQijyRJFItc+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec  4 02:52:04 host2 sshd[3547017]: Disconnected from invalid user kali 116.71.135.53 port 59298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-04 02:52:22 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:35534: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-04 02:52:32 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:52274: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.239
country_id: 690791
description:
Dec  4 02:51:53 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.103.4.239, lip=66.85.158.91, TLS, session=<6hEWzBJF64SwZwTv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 02:53:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<8G+J0hJF2tYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  4 02:54:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<KejK1BJFXWhRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec  4 02:54:51 host2 sshd[3549156]: Disconnected from invalid user usuario1 116.71.135.53 port 38262 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.135.53
country_id: 1168579
description:
Dec  4 02:57:15 host2 sshd[3550991]: Disconnected from invalid user developer 116.71.135.53 port 38330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 02:58:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<XweO5BJF5Jg+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-12-04 02:58:54 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:42750: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-12-04 02:59:09 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:54001: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2025-12-04 03:03:44 dovecot_login authenticator failed for ([149.54.51.230]) [149.54.51.230]:43604: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec  4 03:03:54 host2 sshd[3556133]: Disconnected from invalid user superadmin 116.71.135.53 port 38514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-04 03:04:00 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:42672: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec  4 03:04:34 host2 sshd[3556547]: Disconnected from invalid user manager 103.187.165.26 port 50674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.107.9
country_id: 2921044
description:
Dec  4 03:04:58 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.107.9, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<0pjo+xJFJaWd5msJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.207
country_id: 6252001
description:
Dec  4 03:05:14 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.207, lip=66.85.158.91, session=<Nrbc/BJFbvaTuYTP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.101.182
country_id: 2921044
description:
Dec  4 03:05:33 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.101.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<v7kH/hJFEEyd5mW2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.57.57.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.57.57.61 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.236.182.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 71.236.182.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.84.123.107
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.84.123.107 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.27.225.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.27.225.250 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.115.143.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.115.143.182 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.155.185
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.229.155.185 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.255.193.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.255.193.246 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.167.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.207.167.176 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.123.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.235.123.51 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.62.172.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.62.172.17 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.88.173.67
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.88.173.67 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.158.98.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.158.98.111 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Dec  4 03:08:10 host2 sshd[3559059]: Disconnected from invalid user nominatim 116.71.135.53 port 38658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Dec  4 03:08:46 host2 sshd[3559379]: Disconnected from invalid user work 103.193.178.68 port 36730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec  4 03:09:45 host2 sshd[3560191]: Disconnected from invalid user monitoring 103.55.36.22 port 37796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec  4 03:11:50 host2 sshd[3561674]: Disconnected from invalid user pivpn 103.55.36.22 port 53178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.68
country_id: 1643084
description:
Dec  4 03:14:16 host2 sshd[3563265]: Disconnected from invalid user tempuser 103.193.178.68 port 37670 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.12
country_id: 6252001
description:
Dec  4 03:16:23 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.12, lip=66.85.158.91, session=<jj28JBNFXjusaYAM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Dec  4 03:16:53 host2 sshd[3565253]: Disconnected from invalid user admin1 103.193.178.68 port 50406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec  4 03:16:58 host2 sshd[3565339]: Disconnected from invalid user halo 103.187.165.26 port 49376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec  4 03:18:30 host2 sshd[3566482]: Disconnected from invalid user terraria 103.187.165.26 port 55438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Dec  4 03:19:22 host2 sshd[3567130]: Disconnected from invalid user tempuser 103.55.36.22 port 46490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Dec  4 03:19:28 host2 sshd[3567178]: Disconnected from invalid user runner 103.193.178.68 port 53748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Dec  4 03:20:06 host2 sshd[3567731]: Disconnected from invalid user ali 103.187.165.26 port 56478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.64
country_id: 6251999
description:
2025-12-04 03:25:21 dovecot_login authenticator failed for (ADMIN) [212.56.49.64]:18709: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  4 03:26:17 host2 sshd[3572190]: Disconnected from invalid user user 2.57.121.25 port 17405 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.83.217.194
country_id: 1269750
description:
Dec  4 03:27:21 host2 sshd[3572925]: Disconnected from invalid user ubuntu 183.83.217.194 port 42280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.207
country_id: 1819730
description:
Dec  4 03:27:59 host2 sshd[3573297]: Disconnected from invalid user roott 103.143.238.207 port 48596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Dec  4 03:29:03 host2 sshd[3573978]: Disconnected from invalid user deploy 103.143.238.207 port 46768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Dec  4 03:30:29 host2 sshd[3575004]: Disconnected from invalid user lch 34.69.0.72 port 43082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Dec  4 03:31:29 host2 sshd[3575751]: Disconnected from invalid user proradis 69.5.0.120 port 33448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.83.217.194
country_id: 1269750
description:
Dec  4 03:31:22 host2 sshd[3575696]: Disconnected from invalid user qwerty 183.83.217.194 port 51288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Dec  4 03:32:59 host2 sshd[3576700]: Disconnected from invalid user node 34.69.0.72 port 58200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.121.63.246
country_id: 6252001
description:
Dec  4 03:34:09 host2 sshd[3577418]: Disconnected from invalid user deploy 34.121.63.246 port 36334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.251.128
country_id: 1819730
description:
Dec  4 03:35:18 host2 sshd[3578445]: Disconnected from invalid user luis 47.239.251.128 port 39334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.83.217.194
country_id: 1269750
description:
Dec  4 03:35:12 host2 sshd[3578344]: Disconnected from invalid user root2 183.83.217.194 port 21208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Dec  4 03:36:37 host2 sshd[3579563]: Disconnected from invalid user jenkins 34.69.0.72 port 55878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.121.63.246
country_id: 6252001
description:
Dec  4 03:38:07 host2 sshd[3580650]: Disconnected from invalid user superman 34.121.63.246 port 49914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Dec  4 03:38:13 host2 sshd[3580703]: Disconnected from invalid user zimbra 45.78.220.10 port 55558 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.51
country_id: 6252001
description:
Dec  4 03:39:16 host2 pure-ftpd[3581557]: (?@147.185.132.51) [INFO] New connection from 147.185.132.51


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Dec  4 03:39:36 host2 sshd[3580928]: Disconnected from invalid user vpn 69.5.0.120 port 36082 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.142
country_id: 6252001
description:
Dec  4 03:39:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.142, lip=66.85.158.92, session=<GwG7eBNF1bDDuEyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.209
country_id: 6252001
description:
Dec  4 03:40:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.209, lip=66.85.158.92, session=<GZ8YehNFdcDDuEzR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-04 03:40:32 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:48316: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.208
country_id: 6252001
description:
Dec  4 03:40:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.208, lip=66.85.158.92, session=<FqZWeRNFOcjDuEzQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.142
country_id: 6252001
description:
Dec  4 03:40:12 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.142, lip=66.85.158.92, session=<JbzoeRNFk5bDuEyO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.121.63.246
country_id: 6252001
description:
Dec  4 03:40:14 host2 sshd[3582274]: Disconnected from invalid user kafka 34.121.63.246 port 45848 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.57
country_id: 6251999
description:
Dec  4 03:41:24 host2 pure-ftpd[3583267]: (?@148.113.193.57) [INFO] New connection from 148.113.193.57


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.57
country_id: 6251999
description:
Dec  4 03:41:37 host2 pure-ftpd[3583395]: (?@148.113.193.57) [INFO] New connection from 148.113.193.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-04 03:40:56 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:49244: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-04 03:41:03 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:44575: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-04 03:41:17 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:59030: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.60
country_id: 6252001
description:
Dec  4 03:42:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UMGJgBNFjtKTuYQ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  4 03:42:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<hsINghNFjENRvaKO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.0.120
country_id: 1643084
description:
Dec  4 03:45:32 host2 sshd[3587155]: Disconnected from invalid user odoo 69.5.0.120 port 38732 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.249.242.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.249.242.165 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.198.63.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.198.63.195 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.116.12.66
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.116.12.66 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.47.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.149.47.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.57.116
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.57.116 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.207.53.230
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.207.53.230 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.202.188.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.202.188.133 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.11.207.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.11.207.184 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.197.208
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.218.197.208 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.120.106
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.120.106 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.249.55.106 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.146.62.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.146.62.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.99.185.195
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.99.185.195 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec  4 03:50:53 host2 sshd[3592064]: Disconnected from invalid user laravel 20.46.50.43 port 58178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec  4 03:54:54 host2 sshd[3595536]: Disconnected from invalid user superset 20.46.50.43 port 44936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Dec  4 03:56:04 host2 sshd[3596943]: Disconnected from invalid user devuser 20.46.50.43 port 59302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Dec  4 03:56:08 host2 sshd[3597015]: Disconnected from invalid user test 45.78.220.10 port 38066 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 03:56:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<SpN+tBNFLN0+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec  4 03:56:43 host2 sshd[3597500]: Disconnected from invalid user superset 103.224.247.23 port 38778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-04 03:58:17 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:52298: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec  4 03:58:37 host2 sshd[3599343]: Disconnected from invalid user jacob 20.46.50.43 port 45850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Dec  4 03:58:44 host2 sshd[3599401]: Disconnected from invalid user sens 45.78.220.10 port 41896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 03:57:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<vSosuRNFBJ4+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-04 03:59:04 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:47359: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.224.247.23
country_id: 1269750
description:
Dec  4 03:59:13 host2 sshd[3599876]: Disconnected from invalid user abhi 103.224.247.23 port 60348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec  4 03:59:58 host2 sshd[3600391]: Disconnected from invalid user dev 20.46.50.43 port 40702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec  4 04:00:25 host2 sshd[3601025]: Disconnected from invalid user dev 103.224.247.23 port 55492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.62.247
country_id: 6252001
description:
Dec  4 04:03:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=165.227.62.247, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<yy1KzBNFFLOl4z73>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.78
country_id: 597427
description:
2025-12-04 04:03:28 dovecot_login authenticator failed for (ADMIN) [194.32.122.78]:42258: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Dec  4 04:03:50 host2 sshd[3604594]: Disconnected from invalid user testuser 45.78.220.10 port 42202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 04:04:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<uWZv0RNFGow+PIdo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 04:05:29 host2 sshd[3605799]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  4 04:07:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<KbW42hNFdLGLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec  4 04:08:48 host2 sshd[3609448]: Disconnected from invalid user tibero 102.88.137.213 port 33435 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Dec  4 04:08:53 host2 sshd[3609472]: Disconnected from invalid user ubuntu 45.78.220.10 port 49444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 04:10:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<83WH5BNFLt8XXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Dec  4 04:11:31 host2 sshd[3611719]: Disconnected from invalid user superadmin 102.88.137.213 port 1337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-04 04:12:12 dovecot_plain authenticator failed for (nonsum) [94.206.93.90]:48767: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-04 04:12:14 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (ilogical) [76.157.219.158]:58304: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-04 04:17:49 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:44172: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Dec  4 04:19:15 host2 sshd[3619928]: Disconnected from invalid user test 23.227.147.163 port 35970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec  4 04:20:14 host2 sshd[3620998]: Disconnected from invalid user steam 23.227.147.163 port 44306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec  4 04:22:09 host2 sshd[3622953]: Disconnected from invalid user jrodrig 23.227.147.163 port 33094 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.193.248.129
country_id: 6252001
description:
[2025-12-04 04:26:13 +0530] info [cpaneld] 68.193.248.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.51.52.52
country_id: 6252001
description:
[2025-12-04 04:26:17 +0530] info [cpaneld] 136.51.52.52 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.14.27.115
country_id: 6252001
description:
[2025-12-04 04:26:36 +0530] info [cpaneld] 68.14.27.115 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.178.28.86
country_id: 6252001
description:
[2025-12-04 04:26:37 +0530] info [cpaneld] 107.178.28.86 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.186.42
country_id: 6252001
description:
[2025-12-04 04:26:39 +0530] info [cpaneld] 76.50.186.42 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.116.138.29
country_id: 6252001
description:
[2025-12-04 04:26:43 +0530] info [cpaneld] 24.116.138.29 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.186.40
country_id: 6252001
description:
[2025-12-04 04:26:15 +0530] info [cpaneld] 76.176.186.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.94.118.62
country_id: 6252001
description:
[2025-12-04 04:26:25 +0530] info [whostmgrd] 173.94.118.62 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.180.45.141
country_id: 6252001
description:
[2025-12-04 04:26:27 +0530] info [cpaneld] 67.180.45.141 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.172.4.98
country_id: 6252001
description:
[2025-12-04 04:26:30 +0530] info [cpaneld] 71.172.4.98 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.243.51.12
country_id: 6252001
description:
[2025-12-04 04:26:33 +0530] info [cpaneld] 73.243.51.12 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.78.18.125
country_id: 6252001
description:
[2025-12-04 04:26:41 +0530] info [cpaneld] 172.78.18.125 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Dec  4 04:29:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.31, lip=66.85.158.92, session=<KsCEKhRFddFbxJgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.117
country_id: 3017382
description:
Dec  4 04:29:47 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.117, lip=66.85.158.92, session=<hL87KxRFu91bxJh1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.196
country_id: 2510769
description:
Dec  4 04:30:42 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=139.28.190.196, lip=66.85.158.91, TLS, session=<50tZLRRFi4SLHL7E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Dec  4 04:29:59 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.116, lip=66.85.158.92, session=<huXuKxRF47pbxJh0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.24
country_id: 3017382
description:
Dec  4 04:30:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.24, lip=66.85.158.92, session=<vmMhLBRFq4JbxJgY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.119
country_id: 3469034
description:
Dec  4 04:31:13 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.128.119, lip=66.85.158.91, TLS, session=</flCLxRFIZa/NYB3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Dec  4 04:36:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, TLS, session=<yrSTQRRFZu/G6xhg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  4 04:36:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<Z+NLQhRFHtLKm18C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-12-04 04:43:26 dovecot_login authenticator failed for (dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:46164: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-12-04 04:43:41 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:34526: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-04 04:47:22 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:42668: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-04 04:46:56 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:45615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-04 04:47:03 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:46053: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-04 04:47:13 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:38056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 04:48:10 host2 sshd[3646842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Dec  4 04:53:33 host2 sshd[3650218]: Disconnected from invalid user amssys 78.187.21.105 port 50148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-04 04:54:09 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:41432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2025-12-04 04:54:23 dovecot_login authenticator failed for ([24.83.135.122]) [24.83.135.122]:41104: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 04:55:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oxtZhhRF1okXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 04:57:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+hEyjhRFSOEXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec  4 04:59:44 host2 sshd[3654910]: Disconnected from invalid user max 154.82.113.12 port 55652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.65
country_id: 1880251
description:
Dec  4 05:01:27 host2 sshd[3656273]: Disconnected from invalid user newuser 45.78.203.65 port 52154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec  4 05:01:31 host2 sshd[3656391]: Disconnected from invalid user dev 154.82.113.12 port 38458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec  4 05:02:49 host2 sshd[3657223]: Disconnected from invalid user sam 45.78.200.235 port 46786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec  4 05:02:50 host2 sshd[3657236]: Disconnected from invalid user admin 94.254.0.234 port 34032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.113.12
country_id: 1819730
description:
Dec  4 05:02:55 host2 sshd[3657270]: Disconnected from invalid user pivpn 154.82.113.12 port 37526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec  4 05:03:22 host2 sshd[3657821]: Disconnected from invalid user usuario2 78.187.21.105 port 60698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec  4 05:04:15 host2 sshd[3658358]: Disconnected from invalid user devuser 154.82.113.12 port 41648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 05:05:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<QpYNqxRFEJE+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec  4 05:05:37 host2 sshd[3659291]: Disconnected from invalid user vps 154.82.113.12 port 55660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec  4 05:07:18 host2 sshd[3660340]: Disconnected from invalid user esuser 94.254.0.234 port 43434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 05:07:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ziLOsRRFHJU+PIdr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.254.0.234
country_id: 2661886
description:
Dec  4 05:09:30 host2 sshd[3661944]: Disconnected from invalid user admin 94.254.0.234 port 45714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec  4 05:11:37 host2 sshd[3663721]: Disconnected from invalid user martin 94.254.0.234 port 34414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 05:11:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<X0v0wBRFbss+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.65
country_id: 1880251
description:
Dec  4 05:11:51 host2 sshd[3663999]: Disconnected from invalid user bot 45.78.203.65 port 48044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Dec  4 05:14:36 host2 sshd[3665951]: Disconnected from invalid user ansible 187.45.100.0 port 56503 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.65
country_id: 1880251
description:
Dec  4 05:15:19 host2 sshd[3665741]: Disconnected from invalid user test 45.78.203.65 port 35782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec  4 05:16:20 host2 sshd[3667255]: Disconnected from invalid user cyril 45.78.200.235 port 41372 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Dec  4 05:19:32 host2 sshd[3669626]: Disconnected from invalid user oscar 107.189.29.175 port 34990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec  4 05:20:36 host2 sshd[3670501]: Disconnected from invalid user devuser 107.189.29.175 port 60312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Dec  4 05:20:58 host2 sshd[3670723]: Disconnected from invalid user test01 187.45.100.0 port 34159 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec  4 05:21:30 host2 sshd[3671030]: Disconnected from invalid user martin 45.78.200.235 port 49998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.3
country_id: 2635167
description:
2025-12-04 05:22:19 dovecot_login authenticator failed for (ADMIN) [45.133.172.3]:59125: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec  4 05:22:42 host2 sshd[3671952]: Disconnected from invalid user rich 107.189.29.175 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Dec  4 05:24:12 host2 sshd[3673099]: Disconnected from invalid user admin 187.45.100.0 port 40701 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.45.100.0
country_id: 3469034
description:
Dec  4 05:27:34 host2 sshd[3675431]: Disconnected from invalid user tmp 187.45.100.0 port 36685 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.235
country_id: 1880251
description:
Dec  4 05:31:30 host2 sshd[3678244]: Disconnected from invalid user anaconda 45.78.200.235 port 34130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.122
country_id: 3865483
description:
Dec  4 05:37:57 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.11.195.122, lip=66.85.158.91, TLS, session=<62HcHRVFj+e+C8N6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.19
country_id: 690791
description:
Dec  4 05:38:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.6.19, lip=66.85.158.91, TLS, session=<cVUcHxVFocywZwYT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  4 05:43:53 host2 sshd[3688036]: Disconnected from invalid user admin 2.57.121.112 port 30741 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 05:45:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sQXkOhVFHpEXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.103.53.44
country_id: 1269750
description:
Dec  4 05:46:53 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.103.53.44, lip=66.85.158.91, TLS, session=<TkKiPRVF0oVnZzUs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.29.185.162
country_id: 1643084
description:
Dec  4 05:47:19 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr>, method=PLAIN, rip=103.29.185.162, lip=66.85.158.91, TLS, session=<qbojPxVFBulnHbmi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.214
country_id: 3865483
description:
Dec  4 05:58:11 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=181.191.223.214, lip=66.85.158.91, TLS, session=<L1Q7ZhVFrd+1v9/W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.103
country_id: 1269750
description:
Dec  4 05:58:32 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.103, lip=66.85.158.91, TLS, session=<0U2DZxVFHapnEqZn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.144.44.57
country_id: 6252001
description:
Dec  4 06:00:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.144.44.57, lip=66.85.158.92, TLS handshaking: Connection closed, session=<w1N2bxVF2rYDkCw5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec  4 06:02:58 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<cNyFeBVFQpVChJlw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 06:04:54 host2 sshd[3704548]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.138
country_id: 6251999
description:
2025-12-04 06:04:15 dovecot_login authenticator failed for (ADMIN) [66.56.81.138]:18909: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Dec  4 06:05:10 host2 sshd[3704847]: Disconnected from invalid user crafty 27.254.185.64 port 43900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  4 06:06:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<Pyg4hBVFDzhRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Dec  4 06:08:49 host2 sshd[3706988]: Disconnected from invalid user vendas 27.254.185.64 port 35940 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.208.113
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.150.208.113 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.167.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.241.167.31 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.86.142.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.86.142.243 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.3.228
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 129.222.3.228 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.107.31.152
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.107.31.152 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.155.149.184
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.155.149.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.231.138.25
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.231.138.25 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.137.100.70
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.137.100.70 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.59.248.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.59.248.29 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Dec  4 06:10:10 host2 sshd[3708086]: Disconnected from invalid user vlad 27.254.185.64 port 8830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Dec  4 06:10:53 host2 sshd[3708540]: Disconnected from invalid user erpnext 122.166.49.42 port 54464 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.116.149.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.116.149.54 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.174.182.12
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.174.182.12 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.211.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.211.153 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.23.122.235
country_id: 895949
description:
Dec  4 06:11:29 host2 sshd[3708928]: Disconnected from invalid user kyt 102.23.122.235 port 10933 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Dec  4 06:11:33 host2 sshd[3708965]: Disconnected from invalid user ftpuser 27.254.185.64 port 47284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.23.122.235
country_id: 895949
description:
Dec  4 06:16:14 host2 sshd[3711930]: Disconnected from invalid user teste 102.23.122.235 port 10936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-04 06:16:22 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61746: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 06:18:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<WVU7rxVFUJ8+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 06:18:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<8aBBsRVFiMs+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.76.3
country_id: 6252001
description:
Dec  4 06:23:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=146.190.76.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<QoVHwxVF2LSSvkwD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  4 06:26:04 host2 sshd[3718851]: Disconnected from invalid user user 2.57.121.25 port 15755 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.224.132.77
country_id: 690791
description:
Dec  4 06:27:21 host2 sshd[3720227]: Disconnecting invalid user admin 159.224.132.77 port 40190: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 159.224.132.77
country_id: 690791
description:
Dec  4 06:27:05 host2 sshd[3719941]: Disconnecting authenticating user root 159.224.132.77 port 39240: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 159.224.132.77
country_id: 690791
description:
Dec  4 06:27:05 host2 sshd[3719941]: error: maximum authentication attempts exceeded for root from 159.224.132.77 port 39240 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-12-04 06:32:26 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:37962: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-04 06:33:20 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:51130: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-04 06:33:22 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:40474: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-04 06:33:41 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:60559: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-04 06:32:54 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:34532: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-04 06:33:05 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:48324: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.214.52.170
country_id: 798544
description:
Dec  4 06:38:29 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.214.52.170, lip=66.85.158.91, session=<NZR+9xVFMs9f1jSq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.34
country_id: 3042225
description:
2025-12-04 06:45:17 dovecot_login authenticator failed for (ADMIN) [91.90.124.34]:11953: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2025-12-04 06:46:59 dovecot_login authenticator failed for ([87.200.94.102]) [87.200.94.102]:39420: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-04 06:47:40 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:44418: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.230.6
country_id: 798544
description:
Dec  4 06:50:37 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=193.43.230.6, lip=66.85.158.91, TLS, session=<O73sIRZFVsLBK+YG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.208.124
country_id: 933860
description:
Dec  4 06:51:04 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.216.208.124, lip=66.85.158.91, TLS, session=<kHpKIxZF258p2NB8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.51
country_id: 3277605
description:
Dec  4 06:56:43 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=188.246.73.51, lip=66.85.158.91, TLS, session=<sc+/NxZFA7y89kkz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.94
country_id: 933860
description:
Dec  4 06:57:06 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=83.143.29.94, lip=66.85.158.91, TLS, session=<jVfiOBZFS6dTjx1e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-04 07:01:24 +0530] info [cpaneld] 43.245.222.27 - yash "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yash (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Dec  4 07:01:24 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.119, lip=66.85.158.91, TLS, session=<cER1SRZFovTG6xh3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec  4 07:03:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Gu+xURZF4tNChJl9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.245
country_id: 6252001
description:
Dec  4 07:04:07 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.245, lip=66.85.158.92, TLS, session=<ALspUxZFDuvG6xj1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-04 07:16:45 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:55773: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  4 07:16:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<rVdRgBZFZcNRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2025-12-04 07:17:18 dovecot_login authenticator failed for (184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:57045: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-04 07:17:34 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:59232: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 07:21:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<FqEqkBZF1rc+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  4 07:22:57 host2 sshd[3763925]: Disconnected from invalid user admin 2.57.121.112 port 11525 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 07:25:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<3I1bnhZFLNc+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.65.65.80
country_id: 2077456
description:
2025-12-04 07:27:06 dovecot_login authenticator failed for 202-65-65-80.ip4.superloop.au [202.65.65.80]:34670: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-04 07:27:31 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:59409: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  4 07:29:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Gj9KrxZFSoo+PIdr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 07:31:28 host2 sshd[3770290]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.154.137.244
country_id: 1643084
description:
2025-12-04 07:40:35 dovecot_login authenticator failed for (ip-103-154-137-244.moratelindo.net.id) [103.154.137.244]:56354: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-04 07:40:55 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:38261: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-04 07:43:59 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:53602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-04 07:44:22 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:34025: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  4 07:44:50 host2 dovecot[2304439]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<aNLF5BZF6oc2rEyT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.159
country_id: 798544
description:
Dec  4 07:46:45 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.29.159, lip=66.85.158.91, TLS, session=<yIGs6hZF46my2B2f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.89
country_id: 2510769
description:
Dec  4 07:46:27 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=45.135.197.89, lip=66.85.158.91, TLS, session=<5F+b6RZFE9Ath8VZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  4 07:49:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, TLS, session=<6mHz9BZFSMI2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-12-04 07:53:04 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:32977: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-12-04 07:53:20 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:46082: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  4 07:53:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<snIdBBdFPsCSOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec  4 07:52:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<KoSXARdFzu5ChJlw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  4 07:53:57 host2 sshd[3788287]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  4 07:55:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<g0kOCxdFAMwXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-12-04 07:56:40 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:37694: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-04 07:57:26 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:47831: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.217
country_id: 2635167
description:
Dec  4 08:07:26 host2 dovecot[2304439]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.217, lip=66.85.158.91, TLS, session=<vWunNRdFGYO594nZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec  4 08:09:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<NIAdPBdFTqSnXpI/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.29
country_id: 2635167
description:
Dec  4 08:08:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.29, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5UP9OhdFF9kjy9Id>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.29
country_id: 2635167
description:
Dec  4 08:09:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.29, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<JtppPhdFSu4jy9Id>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.110
country_id: 6252001
description:
Dec  4 08:10:17 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.110, lip=66.85.158.92, TLS, session=<4YzQPxdF4PHG6xhu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-04 08:10:20 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:52136: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.16
country_id: 2029969
description:
2025-12-04 08:10:22 dovecot_login authenticator failed for (ADMIN) [173.244.58.16]:36372: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:10:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<IV6LQRdFeJgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:11:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<QtVGRRdFnqQDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-04 08:10:58 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:49276: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:12:24 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<nkFjRxdFxpMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:16:56 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<GWWbVxdFYpIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.29
country_id: 2635167
description:
Dec  4 08:17:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.29, lip=66.85.158.92, TLS, session=<1xFDWRdFdOcjy9Id>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.66
country_id: 6252001
description:
Dec  4 08:16:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.66, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<H/14VxdFKMui2JVC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.137.193
country_id: 2921044
description:
Dec  4 08:18:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=139.59.137.193, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WjSFXRdFJsOLO4nB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:17:58 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<R/tPWxdFTKwDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:19:32 host2 dovecot[2304439]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<psXoYBdFXOoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:19:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<8WCwXxdFMrcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:20:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<b6l6YxdFINgDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:20:35 host2 dovecot[2304439]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bsynZBdFCrUDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.200.136
country_id: 3469034
description:
Dec  4 08:20:50 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.87.200.136, lip=66.85.158.91, TLS, session=<LtBnZBdFw8+xV8iI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.110
country_id: 3469034
description:
Dec  4 08:21:10 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.72.78.110, lip=66.85.158.91, TLS, session=<vPisZRdFdsuxSE5u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:21:55 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<r6poaRdFgpkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec  4 08:22:57 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<sS0cbRdFctMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-04 08:23:12 dovecot_login authenticator failed for ([77.89.143.123]) [77.89.143.123]:49254: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-04 08:23:30 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:40191: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-04 08:23:43 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:41863: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec  4 08:24:10 host2 sshd[3813211]: Disconnected from invalid user deploy 64.227.156.63 port 54840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec  4 08:24:40 host2 sshd[3813735]: Disconnected from invalid user odoo15 49.204.74.149 port 37986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.66
country_id: 6252001
description:
Dec  4 08:25:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.66, lip=66.85.158.91, TLS, session=<jkjvdRdFBPCi2JVC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec  4 08:25:30 host2 sshd[3814595]: Disconnected from invalid user shree 161.248.201.228 port 43404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec  4 08:26:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<9mncehdFoLY26lCA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.255.216
country_id: 2921044
description:
Dec  4 08:26:33 host2 pure-ftpd[3815485]: (?@134.209.255.216) [INFO] New connection from 134.209.255.216


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.154.203.193
country_id: 2921044
description:
Dec  4 08:26:33 host2 pure-ftpd[3815492]: (?@207.154.203.193) [INFO] New connection from 207.154.203.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.156.63
country_id: 1269750
description:
Dec  4 08:28:32 host2 sshd[3817108]: Disconnected from invalid user ali 64.227.156.63 port 32968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec  4 08:28:38 host2 sshd[3817198]: Disconnected from invalid user userroot 49.204.74.149 port 53106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec  4 08:29:47 host2 sshd[3818029]: Disconnected from invalid user autcom 64.227.156.63 port 38112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec  4 08:29:54 host2 sshd[3818136]: Disconnected from invalid user botuser 49.204.74.149 port 54310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec  4 08:29:57 host2 sshd[3818176]: Disconnected from invalid user odoo15 105.27.148.94 port 36392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec  4 08:30:27 host2 sshd[3818784]: Disconnected from invalid user autcom 161.248.201.228 port 56820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  4 08:30:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SToXiBdF0IE+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-04 08:31:09 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (wodul) [24.15.216.41]:57634: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Dec  4 08:31:12 host2 sshd[3819371]: Disconnected from invalid user dixi 49.204.74.149 port 55514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.201.228
country_id: 1210997
description:
Dec  4 08:31:57 host2 sshd[3819869]: Disconnected from invalid user shree 161.248.201.228 port 33994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  4 08:32:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<6bXpjRdFILM+PIdo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.249.55.106 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Dec  4 08:34:10 host2 sshd[3821351]: Disconnected from invalid user gerrit 105.27.148.94 port 42792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.55.146
country_id: 1562822
description:
Dec  4 08:36:48 host2 sshd[3823615]: Disconnected from invalid user developer 165.154.55.146 port 36462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.55.146
country_id: 1562822
description:
Dec  4 08:40:41 host2 sshd[3826804]: Disconnected from invalid user botuser 165.154.55.146 port 47908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.161.235.122
country_id: 2300660
description:
2025-12-04 08:41:20 dovecot_plain authenticator failed for (BLQ8UWWR76TP98) [154.161.235.122]:36390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.55.146
country_id: 1562822
description:
Dec  4 08:42:36 host2 sshd[3828472]: Disconnected from invalid user foundry 165.154.55.146 port 43248 [preauth]


