# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:33:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<6l+B7hdEqs4DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 15:34:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<zCwV7xdEIqiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 15:34:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<N0687xdE/MJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 15:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tPN38hdE4EVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 15:35:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wCcS9BdERqGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 15:37:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ve3N/BdEFJanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 15:39:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Ek+GAhhEZL2ElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 15:39:51 host2 sshd[2433762]: Disconnected from invalid user dallin 62.60.131.157 port 21476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 15:40:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<tVv0BBhEMuJo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 15:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5IgjCxhEoLOl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 6251999
description:
Nov 21 15:42:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=86.54.31.40, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<X5qIDRhE7KlWNh8o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 15:42:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hVfeDRhEPrkrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.215
country_id: 3017382
description:
Nov 21 15:46:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.215, lip=66.85.158.91, session=<0XpkHBhEG7hb51nX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.80
country_id: 3017382
description:
Nov 21 15:46:59 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.80, lip=66.85.158.91, session=<tmElHRhETdpb51lQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.84
country_id: 3017382
description:
Nov 21 15:47:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.84, lip=66.85.158.91, session=<7p1XHRhE2bhb51lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Nov 21 15:46:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.209, lip=66.85.158.91, session=<Z3HHGxhEa9Bb51nR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 15:47:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<hGSGHhhEgt5z8UML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-11-21 15:47:27 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (ancenress) [2.135.31.74]:37915: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 15:49:22 host2 sshd[2452843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.88.34.53
country_id: 6252001
description:
Nov 21 15:49:16 host2 sshd[2452785]: Disconnected from invalid user odoo 47.88.34.53 port 49536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:52:20 host2 sshd[2454757]: Disconnected from invalid user red 187.33.158.113 port 60662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 15:52:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<w/BwMRhEardn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 15:56:04 host2 sshd[2457693]: Disconnected from invalid user dallin 62.60.131.157 port 34808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-21 15:56:06 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:37042: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-21 15:55:41 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:53310: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:56:55 host2 sshd[2458098]: Disconnected from invalid user odoo 187.33.158.113 port 34336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 15:58:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<m7GPRBhEo1YvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 15:59:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hqYmSRhE8s4rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:59:37 host2 sshd[2459557]: Disconnected from invalid user mati 187.33.158.113 port 35518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 15:59:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<YsntShhELo2UcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:04:22 host2 sshd[2463602]: Disconnected from invalid user lm 41.83.197.23 port 38168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 16:04:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<E5lzXBhE9oBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 16:04:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<umyvXBhEyoFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 16:04:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<eaHzXBhEhts+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:06:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<ZY9HZBhEJk8v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 16:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<NPl9ZBhEfoxAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 16:08:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<T85SaBhEop5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 16:08:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<cKRkaxhEhKBnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 16:15:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<F8iAghhEJIxz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 16:16:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<GnNAhRhEsLqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 16:16:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<UVUohhhEkquYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 16:17:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<UNpgixhExotnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 16:20:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<TlsckxhEuNaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 16:20:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<unphlRhEwuWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:21:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<kF9LmBhEIt4v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<NeBNoBhEkOE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dQFFoBhETMmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 16:24:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<XMisoRhEIpR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 16:24:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ILC4oRhEhOE5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<oNhQoBhEPvanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 16:24:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<34nzoRhEZxNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 16:24:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<wwn3oRhENuZo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:25:16 host2 sshd[2476272]: Disconnected from invalid user sia 204.152.195.145 port 35872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 16:26:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<nIYUqRhEkI2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 16:26:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<LKz+qRhEOKZAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:26:31 host2 sshd[2477031]: Disconnected from invalid user terra 204.152.195.145 port 35998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:27:22 host2 sshd[2477468]: Disconnected from invalid user test 103.4.92.103 port 36328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:28:10 host2 sshd[2478030]: Disconnected from invalid user gh 41.83.197.23 port 50502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.85.105.108
country_id: 3469034
description:
Nov 21 16:28:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=187.85.105.108, lip=66.85.158.91, session=<Le0mshhEBMS7VWls>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 16:28:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<X+ISsxhEVoGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.52
country_id: 3175395
description:
Nov 21 16:29:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.179.52, lip=66.85.158.91, TLS, session=<TahvsxhEfNvZGrM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 16:29:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<6jmftRhE4N2SOC+J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:30:34 host2 sshd[2479980]: Disconnected from invalid user zero 204.152.195.145 port 36398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-21 16:30:39 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:46458: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-21 16:30:54 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:33662: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:32:04 host2 sshd[2481068]: Disconnected from invalid user sfc 41.83.197.23 port 57794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 16:31:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<CHfOuxhEGNQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:31:58 host2 sshd[2480991]: Disconnected from invalid user admin 204.152.195.145 port 36526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.10.97.94
country_id: 1643084
description:
2025-11-21 16:33:49 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [182.10.97.94]:29551: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.6
country_id: 2264397
description:
Nov 21 16:34:36 host2 pure-ftpd[2482504]: (?@185.226.198.6) [INFO] New connection from 185.226.198.6


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 21 16:34:39 host2 pure-ftpd[2482541]: (?@185.226.198.7) [INFO] New connection from 185.226.198.7


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.4
country_id: 2264397
description:
Nov 21 16:34:47 host2 pure-ftpd[2482641]: (?@185.226.198.4) [INFO] New connection from 185.226.198.4


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.5
country_id: 2264397
description:
Nov 21 16:34:47 host2 pure-ftpd[2482649]: (?@185.226.198.5) [INFO] New connection from 185.226.198.5


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:34:23 host2 sshd[2482405]: Disconnected from invalid user admin 103.4.92.103 port 42195 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 16:36:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<k76czxhEpLdnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:36:08 host2 sshd[2483501]: Disconnected from invalid user wg 103.4.92.103 port 57773 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.153
country_id: 3175395
description:
Nov 21 16:41:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.208.106.153, lip=66.85.158.91, TLS, session=<CUGG3RhEeae50GqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.124
country_id: 3175395
description:
Nov 21 16:40:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=217.26.179.124, lip=66.85.158.91, TLS, session=<69M33BhEaLDZGrN8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 16:41:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<kVNV3xhEOsVn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:41:34 host2 sshd[2486837]: Disconnected from invalid user terra 103.4.92.103 port 48051 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 16:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<KvTA4RhEFkAvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 16:43:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<BVSt5xhEYqFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 16:45:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<s3mq7BhEhs4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.44.160.11
country_id: 149590
description:
2025-11-21 16:46:45 dovecot_plain authenticator failed for (B9MP3) [196.44.160.11]:53929: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 16:47:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<Q7CF9RhEkOGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 16:48:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<6Hi49xhE1NMrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.44.160.11
country_id: 149590
description:
2025-11-21 16:50:40 dovecot_login authenticator failed for (B9MP3) [196.44.160.11]:53929: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:55:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<gD8vEhlE0Fgv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 16:56:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<lwciFBlE9shA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.178.126
country_id: 6252001
description:
Nov 21 16:57:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=159.223.178.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wutcGhlEesKf37J+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-11-21 17:00:00 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:62726: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-21 17:00:13 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:36589: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 17:01:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<85DUJhlExK1AF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 17:01:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<0qUXKBlECtVn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 17:01:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<EiE5KRlENLikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 17:02:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<7LqqKhlEoq2YNbyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.178.126
country_id: 6252001
description:
Nov 21 17:03:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.178.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bSRDLhlEyLCf37J+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:03:46 host2 sshd[2500993]: Disconnected from invalid user last 46.28.24.69 port 48560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:06:48 host2 sshd[2503014]: Disconnected from invalid user admin 46.28.24.69 port 41664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:07:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<75a2PRlELrqElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:08:30 host2 sshd[2503986]: Disconnected from invalid user mark 182.8.228.154 port 3827 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 17:08:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<IlYZQBlE3JFo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:09:49 host2 sshd[2504692]: Disconnected from invalid user ica 46.28.24.69 port 54450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 17:10:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<vTdmRhlE0O+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 17:10:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<+lTERxlE5rAv7YNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-11-21 17:11:16 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:48628: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-21 17:11:19 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53954: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-11-21 17:11:42 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:56032: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-11-21 17:12:04 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:39532: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 17:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Q2hvTRlETJmWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:12:18 host2 sshd[2506618]: Disconnected from invalid user seafile 182.8.228.154 port 63894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 17:12:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<RMCITxlE5qoFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:13:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<OaOfURlEENKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 17:13:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Ti3XURlEapJz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:13:56 host2 sshd[2507615]: Disconnected from invalid user huser 89.97.218.142 port 34168 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:13:58 host2 sshd[2507630]: Disconnected from invalid user karol 182.8.228.154 port 30154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-21 17:14:11 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:53170: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-21 17:14:21 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:40072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 17:15:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kBMRWBlE1Stniu0S>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.226.254
country_id: 99237
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 185.75.226.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.94.250.47
country_id: 953987
description:
[2025-11-21 17:16:05 +0530] info [whostmgrd] 197.94.250.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.123.170
country_id: 3865483
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 190.105.123.170 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.67.187.246
country_id: 2635167
description:
[2025-11-21 17:15:42 +0530] info [cpaneld] 5.67.187.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.75.120
country_id: 6252001
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 107.216.75.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.160.168.67
country_id: 1820814
description:
[2025-11-21 17:15:50 +0530] info [cpaneld] 119.160.168.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.30.97.9
country_id: 587116
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 81.30.97.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.212.242
country_id: 1282988
description:
[2025-11-21 17:15:51 +0530] info [cpaneld] 103.77.212.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.73.168.111
country_id: 390903
description:
[2025-11-21 17:15:55 +0530] info [cpaneld] 85.73.168.111 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.224.82
country_id: 1269750
description:
[2025-11-21 17:15:56 +0530] info [cpaneld] 49.37.224.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.165.64
country_id: 1269750
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 103.134.165.64 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.49.15.5
country_id: 1694008
description:
[2025-11-21 17:15:56 +0530] info [whostmgrd] 27.49.15.5 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.253.3
country_id: 3865483
description:
[2025-11-21 17:16:00 +0530] info [cpaneld] 186.22.253.3 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.94.10.200
country_id: 1694008
description:
[2025-11-21 17:16:02 +0530] info [whostmgrd] 119.94.10.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.110.16.103
country_id: 1269750
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 103.110.16.103 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.22.175.222
country_id: 3996063
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 38.22.175.222 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.93.221
country_id: 1269750
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 49.43.93.221 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.108.91.61
country_id: 3469034
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 187.108.91.61 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.234.142.84
country_id: 2921044
description:
[2025-11-21 17:15:45 +0530] info [cpaneld] 93.234.142.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.207.175.254
country_id: 6252001
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 68.207.175.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.158.203.54
country_id: 690791
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 78.158.203.54 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.70.73
country_id: 3469034
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 45.172.70.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.248.86.210
country_id: 2017370
description:
[2025-11-21 17:15:58 +0530] info [cpaneld] 109.248.86.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.123.246
country_id: 3865483
description:
[2025-11-21 17:16:01 +0530] info [whostmgrd] 186.19.123.246 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.119.61
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 45.49.119.61 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.42.228.9
country_id: 1210997
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 103.42.228.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.236.97
country_id: 1733045
description:
[2025-11-21 17:15:58 +0530] info [whostmgrd] 180.75.236.97 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.226.32.163
country_id: 3996063
description:
[2025-11-21 17:16:02 +0530] info [whostmgrd] 177.226.32.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.184.201.26
country_id: 2017370
description:
[2025-11-21 17:16:02 +0530] info [cpaneld] 109.184.201.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.79.80
country_id: 1269750
description:
[2025-11-21 17:16:03 +0530] info [cpaneld] 49.36.79.80 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 17:15:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<MwQ1WhlELq52wSaf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.194.200.204
country_id: 1694008
description:
[2025-11-21 17:15:47 +0530] info [cpaneld] 180.194.200.204 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.220.41.69
country_id: 99237
description:
[2025-11-21 17:15:51 +0530] info [cpaneld] 91.220.41.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.253.212.147
country_id: 298795
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 212.253.212.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.51.45.201
country_id: 290557
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 2.51.45.201 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.47
country_id: 99237
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 62.201.244.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.134.19
country_id: 6252001
description:
[2025-11-21 17:16:01 +0530] info [cpaneld] 45.50.134.19 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.81.177.53
country_id: 2510769
description:
[2025-11-21 17:15:42 +0530] info [cpaneld] 66.81.177.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.238.48.81
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 71.238.48.81 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.193.175
country_id: 99237
description:
[2025-11-21 17:16:01 +0530] info [cpaneld] 185.56.193.175 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.227
country_id: 99237
description:
[2025-11-21 17:15:57 +0530] info [cpaneld] 185.136.148.227 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.50.215
country_id: 1694008
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 136.158.50.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.202.234.78
country_id: 1694008
description:
[2025-11-21 17:16:03 +0530] info [cpaneld] 112.202.234.78 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:15:33 host2 sshd[2508837]: Disconnected from invalid user last 172.172.130.40 port 35962 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.161.139
country_id: 3469034
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 45.224.161.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.124.209.108
country_id: 6252001
description:
[2025-11-21 17:15:47 +0530] info [cpaneld] 209.124.209.108 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.79.36.121
country_id: 2963597
description:
[2025-11-21 17:15:56 +0530] info [cpaneld] 109.79.36.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.25.56.50
country_id: 1643084
description:
[2025-11-21 17:16:01 +0530] info [whostmgrd] 160.25.56.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.250.11
country_id: 1733045
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 27.125.250.11 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.218.208
country_id: 1605651
description:
[2025-11-21 17:15:45 +0530] info [cpaneld] 182.232.218.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.66.225
country_id: 1512440
description:
[2025-11-21 17:15:48 +0530] info [cpaneld] 84.54.66.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.180
country_id: 99237
description:
[2025-11-21 17:15:53 +0530] info [whostmgrd] 212.237.119.180 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.188.56.180
country_id: 6252001
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 71.188.56.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.122.59.105
country_id: 1605651
description:
[2025-11-21 17:15:50 +0530] info [cpaneld] 124.122.59.105 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.129.77.20
country_id: 6252001
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 142.129.77.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.70.217.136
country_id: 6252001
description:
[2025-11-21 17:16:00 +0530] info [whostmgrd] 174.70.217.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.198.4
country_id: 6252001
description:
[2025-11-21 17:16:02 +0530] info [cpaneld] 76.167.198.4 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.229.252.76
country_id: 1269750
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 223.229.252.76 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.225.12
country_id: 1733045
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 180.74.225.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.32.99.9
country_id: 1694008
description:
[2025-11-21 17:15:43 +0530] info [cpaneld] 152.32.99.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.24.210.42
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 8.24.210.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.229.120.129
country_id: 6252001
description:
[2025-11-21 17:15:55 +0530] info [cpaneld] 73.229.120.129 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.25.59.114
country_id: 1694008
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 223.25.59.114 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.228.125
country_id: 102358
description:
[2025-11-21 17:16:15 +0530] info [cpaneld] 188.53.228.125 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.0.72
country_id: 290557
description:
[2025-11-21 17:16:18 +0530] info [cpaneld] 5.107.0.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 17:16:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GEnpXBlEht6l6LP6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.143.250
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 174.160.143.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.29.91
country_id: 1733045
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 60.50.29.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.85
country_id: 3895114
description:
[2025-11-21 17:16:22 +0530] info [cpaneld] 179.60.66.85 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.0.149.165
country_id: 2017370
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 193.0.149.165 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.140.24.49
country_id: 390903
description:
[2025-11-21 17:16:10 +0530] info [cpaneld] 91.140.24.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.198.199.67
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 24.198.199.67 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.194.68.121
country_id: 6252001
description:
[2025-11-21 17:16:25 +0530] info [cpaneld] 108.194.68.121 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.181.68.197
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 70.181.68.197 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.87.84.84
country_id: 1643084
description:
[2025-11-21 17:16:15 +0530] info [cpaneld] 210.87.84.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.92.113
country_id: 6252001
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 216.164.92.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.178.133.28
country_id: 6252001
description:
[2025-11-21 17:16:23 +0530] info [cpaneld] 70.178.133.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.129.147
country_id: 587116
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 62.217.129.147 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.67.6
country_id: 1282988
description:
[2025-11-21 17:16:19 +0530] info [cpaneld] 27.34.67.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.85.226.4
country_id: 3469034
description:
[2025-11-21 17:16:22 +0530] info [cpaneld] 177.85.226.4 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.188.30
country_id: 1210997
description:
[2025-11-21 17:16:07 +0530] info [cpaneld] 114.130.188.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.55.8
country_id: 2215636
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 165.16.55.8 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.48.197.207
country_id: 1269750
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 103.48.197.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.219.32
country_id: 1282988
description:
[2025-11-21 17:16:11 +0530] info [cpaneld] 103.134.219.32 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.122.136
country_id: 3865483
description:
[2025-11-21 17:16:30 +0530] info [cpaneld] 190.105.122.136 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.15.59.59
country_id: 298795
description:
[2025-11-21 17:16:34 +0530] info [cpaneld] 95.15.59.59 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.173.115.94
country_id: 690791
description:
[2025-11-21 17:16:07 +0530] info [cpaneld] 185.173.115.94 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.133.77.89
country_id: 1733045
description:
[2025-11-21 17:16:10 +0530] info [whostmgrd] 115.133.77.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.229.186
country_id: 1269750
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 106.222.229.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.237.42.17
country_id: 1605651
description:
[2025-11-21 17:16:17 +0530] info [cpaneld] 49.237.42.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.213.48.162
country_id: 192950
description:
[2025-11-21 17:16:20 +0530] info [cpaneld] 102.213.48.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.181.13.212
country_id: 2635167
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 86.181.13.212 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.231.192.83
country_id: 298795
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 94.231.192.83 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.103.209
country_id: 1643084
description:
[2025-11-21 17:16:09 +0530] info [whostmgrd] 103.163.103.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:16:53 host2 sshd[2509728]: Disconnected from invalid user pivpn 172.172.130.40 port 55824 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.68.128
country_id: 3895114
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 179.60.68.128 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.71.140
country_id: 3865483
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 181.46.71.140 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.26.247.124
country_id: 1210997
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 103.26.247.124 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.104.212.145
country_id: 1562822
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 116.104.212.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.52.67.70
country_id: 1694008
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 122.52.67.70 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.49.233.135
country_id: 6252001
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 173.49.233.135 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:18:14 host2 sshd[2510680]: Disconnected from invalid user wanghao 172.172.130.40 port 38758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:18:23 host2 sshd[2510767]: Disconnected from invalid user manjaro 89.97.218.142 port 34258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:18:51 host2 sshd[2510961]: Disconnected from invalid user mostafa 182.8.228.154 port 21033 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 17:19:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<BcFkZxlE+utnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 17:20:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DZHJaxlEQOUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 17:20:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<zWllbBlEttNnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 17:21:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<NoMBcBlEsqFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 17:21:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<r13VbRlEHow+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 17:23:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cVkLdhlEZswXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 17:24:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<MWKXeBlEVJo5gL/H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 17:25:33 host2 sshd[2515870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:25:54 host2 sshd[2516038]: Disconnected from invalid user ubuntu 89.97.218.142 port 34382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 17:26:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<rO2dgRlEhyovWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 17:28:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61414: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:28:29 host2 sshd[2517534]: Disconnected from invalid user test01 43.133.254.75 port 42454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:29:14 host2 sshd[2517957]: Disconnected from invalid user ali 198.23.143.193 port 38964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 17:30:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<IfB+kBlE9NJn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:31:22 host2 sshd[2519446]: Disconnected from invalid user yuli 43.133.254.75 port 41672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:31:37 host2 sshd[2519609]: Disconnected from invalid user dell 102.88.137.80 port 1087 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:31:42 host2 sshd[2519690]: Disconnected from invalid user hung 89.97.218.142 port 34460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:31:44 host2 sshd[2519722]: Disconnected from invalid user roott 198.23.143.193 port 43356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:34:03 host2 sshd[2521159]: Disconnected from invalid user localhost 198.23.143.193 port 47744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:34:34 host2 sshd[2521455]: Disconnected from invalid user sharing 102.88.137.80 port 1087 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 17:35:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<+FUgohlEKriUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-21 17:36:28 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:60868: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:36:38 host2 sshd[2522990]: Disconnected from invalid user arash 43.133.254.75 port 40104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-21 17:36:56 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:45772: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 17:37:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XYZwqBlEYJQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:39:04 host2 sshd[2524441]: Disconnected from invalid user lab 198.23.143.193 port 56524 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 17:42:49 host2 sshd[2527049]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-11-21 17:43:28 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:38664: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:43:33 host2 sshd[2527458]: Disconnected from invalid user testuser 102.88.137.80 port 1525 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-21 17:43:45 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:56100: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 17:44:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YcKEwBlEhMZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 17:44:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<xuA7wRlESqlz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 17:45:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<4U7TwxlEGgsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 17:45:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<dlUCxRlEoO0+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.95.81.217
country_id: 1269750
description:
2025-11-21 17:46:20 dovecot_plain authenticator failed for (Q171B58071) [103.95.81.217]:13775: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:46:36 host2 sshd[2529943]: Disconnected from invalid user dell 102.88.137.80 port 33305 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 17:48:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<9N4UzhlEfIekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 17:49:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<A2Mm0hlEVqGYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.120
country_id: 3469034
description:
Nov 21 17:51:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.8.251.120, lip=66.85.158.91, TLS, session=<IYgv2hlE+9KxCPt4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.87.137
country_id: 3469034
description:
Nov 21 17:52:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=131.196.87.137, lip=66.85.158.91, TLS, session=<JVhh2xlERK6DxFeJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 17:52:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<lewd3xlERKlo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:55:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<uJ6t5xlEYIuElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 17:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<SUsU7xlE6slnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 17:57:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<rZAB7xlEanGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:00:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<GGCl+RlE4A8v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:00:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<QXp5+xlEkKCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 18:01:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7odP/RlE1seWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:01:44 host2 sshd[2544505]: Disconnected from invalid user admin 41.216.181.21 port 45140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:03:10 host2 sshd[2546060]: Disconnected from invalid user dmdba 200.46.125.168 port 39596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 18:03:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<YXZeBRpEuNln9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 18:05:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<xXUACxpE1J0+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 18:05:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ljWdCxpE0tal6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:05:45 host2 sshd[2548844]: Disconnected from invalid user ubuntu 41.216.181.21 port 33940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:07:00 host2 sshd[2549993]: Disconnected from invalid user ubuntu 41.216.181.21 port 34022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 18:06:26 host2 sshd[2549462]: Disconnected from invalid user grady 62.60.131.157 port 46700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 18:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ELfRERpEq0Zniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 18:07:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ds/MExpERud2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:07:27 host2 sshd[2550453]: Disconnected from invalid user es 200.46.125.168 port 54122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:09:22 host2 sshd[2552088]: Disconnected from invalid user user 41.216.181.21 port 34184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:09:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XoFGHBpEhrormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 18:10:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<uoDrHxpEZBMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 18:11:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<TgteIhpETqc+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:14:10 host2 sshd[2556436]: Disconnected from invalid user ajay 200.46.125.168 port 39754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 18:14:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<3xH+KxpE0uFz8UML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.64.202
country_id: 149590
description:
2025-11-21 18:15:35 dovecot_plain authenticator failed for (X58MAJ152S6) [41.59.64.202]:56038: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-21 18:16:59 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (sesism) [24.1.200.187]:35488: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:16:54 host2 sshd[2558806]: Disconnected from invalid user devil 200.46.125.168 port 44349 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 18:17:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<9oYzNhpEsshAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 18:17:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JIuVOBpE8LBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 18:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<hqs5RBpE9qVnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 18:21:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<0+abRRpEluBn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 18:22:26 host2 sshd[2562783]: Disconnected from invalid user grady 62.60.131.157 port 53951 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 18:23:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<+nZjTBpEPLQ5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 18:25:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<qG7uUhpEHrWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:26:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<AMlyWBpE8tErmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 18:28:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<063zXBpEWOM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 18:28:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<nV56XRpEBOJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:33:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<X5PocRpEjDgv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 18:33:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eDDscRpE3MtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 18:34:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<aavmdBpElOiYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-21 18:34:52 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:36734: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 18:34:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ooXydBpEjsqkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-21 18:35:07 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53294: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 18:37:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<//93fhpEJNho7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:39:07 host2 sshd[2574481]: Disconnected from invalid user zhangke 181.123.136.11 port 40850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:39:56 host2 sshd[2574953]: Disconnected from invalid user ftp_user 45.78.193.174 port 49328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:40:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<bFijiRpEApmElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:42:39 host2 sshd[2577024]: Disconnected from invalid user oracle 45.78.193.174 port 52054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 18:44:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<BClqlxpEFGCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:45:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<4pd1nBpEyqeElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 18:46:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<ki6znRpEUpM+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 18:46:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Y74lnhpEfJNz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:48:03 host2 sshd[2581063]: Disconnected from invalid user finn 45.78.193.174 port 55746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 18:48:24 host2 sshd[2581327]: Disconnected from invalid user newuser 201.217.12.57 port 60750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:48:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<NLGBphpEsDsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 18:51:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<j7iDrxpEdp6WXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:50:17 host2 sshd[2582607]: Disconnected from invalid user admin1 181.123.136.11 port 45206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 18:51:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<FiNxshpE5NZn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 18:52:03 host2 sshd[2583833]: Disconnected from invalid user random 201.217.12.57 port 49374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 18:52:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<Kwy+sxpE+NdAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 18:52:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<my42tRpEGJCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 18:55:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mQOvvRpERPMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:55:53 host2 sshd[2586914]: Disconnected from invalid user administrator 181.123.136.11 port 49130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:56:07 host2 sshd[2587089]: Disconnected from invalid user bitwarden 45.78.193.174 port 44478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 18:56:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tDQYxBpELxRniu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 18:57:21 host2 sshd[2587985]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:57:42 host2 sshd[2588181]: Disconnected from invalid user soporte 181.123.136.11 port 55910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 18:58:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<hPKCyhpEesw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 18:59:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<5hPFyxpEZsB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 18:59:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<GI6QzBpE3IJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:59:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iDa2zBpEkMArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 19:05:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<rIKz4xpEqNdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-21 19:05:54 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:46055: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-21 19:06:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:48262: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 19:08:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<tTiu7BpEssBnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-11-21 19:10:09 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (unhaffic) [98.192.74.183]:37818: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 19:10:28 host2 sshd[2597275]: Disconnected from invalid user ftp_user 201.217.12.57 port 35994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 19:11:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<y/la9xpEJIBn76Vy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 19:14:43 host2 sshd[2600493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 19:15:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<UPMKBRtEWpFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 19:16:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iacqCRtEHsYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 19:20:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<mIIAGBtEvNI5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 19:20:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<jz63GBtEst2YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 19:20:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JzUkGhtETrakXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 21 19:21:34 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<i+GNHBtElo258uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 19:21:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<jL5/HRtEVJVo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 19:22:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qElFHhtEuppA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 19:22:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<G2n9HhtEKLIv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Nov 21 19:22:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.91, TLS: Connection closed, session=<InK5HxtE/s7HLZqT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:23:57 host2 sshd[2605686]: Disconnected from invalid user postgres 103.144.146.186 port 55392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 19:24:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<CJryJxtE8IOElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:25:41 host2 sshd[2606838]: Disconnected from invalid user martina 103.144.146.186 port 40825 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 21 19:26:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<v3wLLxtEBsC58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 19:28:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<3e6UNRtE/seSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 19:29:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<GqiNOhtEbI+ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 19:30:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<84zWOhtELI1nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 21 19:29:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<NJC4OBtE1LY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 19:29:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<pQtxOhtEaus+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-21 19:30:46 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (saing) [73.68.220.15]:43648: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 19:31:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<W4RFPhtE7LKnYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:32:11 host2 sshd[2610539]: Disconnected from invalid user user2 103.144.146.186 port 39006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 19:33:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ix41RxtEgu0+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-21 19:36:03 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:49152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-11-21 19:35:34 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:43542: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 19:37:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<4kWuUxtEvGsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 19:39:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<VNjkXBtEW9ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 19:40:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pZ5bXxtENIGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 19:40:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<LbQ9XxtEqoBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 19:41:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2j0iYxtEPp2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.221.141.255
country_id: 1269750
description:
Nov 21 19:42:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=117.221.141.255, lip=66.85.158.91, TLS, session=<bNPRZxtEZ6t13Y3/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.89.94.7
country_id: 192950
description:
Nov 21 19:42:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=41.89.94.7, lip=66.85.158.91, session=<hKKDZxtEQo8pWV4H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 19:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<2fkEbBtE1sZz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:47 host2 sshd[2619212]: Disconnecting invalid user admin 176.235.182.73 port 54383: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:45:48 host2 sshd[2619229]: Disconnected from invalid user jenny1 190.111.211.81 port 32802 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:35 host2 sshd[2619094]: Disconnecting authenticating user root 176.235.182.73 port 50471: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:35 host2 sshd[2619094]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 50471 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 19:47:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xNjFdxtEFCxniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.220.177
country_id: 2921044
description:
Nov 21 19:47:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.220.177, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7B9NeBtEH1VEt9yx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 21 19:47:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.227.134.101, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VvtmehtEmHSl44Zl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 19:48:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<dddlfRtESp0rmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:50:24 host2 sshd[2622120]: Disconnected from invalid user shree 190.111.211.81 port 39490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 19:50:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<RaphhRtEErt2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 21 19:51:28 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS, session=<xrmDhxtEhubLN4ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:51:55 host2 sshd[2622809]: Disconnected from invalid user admin 190.111.211.81 port 47456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.130.197.3
country_id: 798544
description:
Nov 21 19:53:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=195.130.197.3, lip=66.85.158.91, TLS, session=<66fAjRtEG6HDgsUD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 19:53:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<O4XjjhtEwLpnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 19:53:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<5nonjxtEqtM+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.235
country_id: 953987
description:
Nov 21 19:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.63.235, lip=66.85.158.91, TLS, session=<x4LijhtEEoFmgT/r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.234.137.17
country_id: 3175395
description:
Nov 21 19:55:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.234.137.17, lip=66.85.158.91, TLS, session=<STWrkxtEh8Zt6okR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 19:55:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<9Jp6lRtEDrxnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.191
country_id: 1269750
description:
Nov 21 19:55:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=103.84.202.191, lip=66.85.158.91, TLS, session=<wRXGlBtE47RnVMq/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 21 19:57:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.208.45, lip=66.85.158.91, session=<qpevmxtEwtSUcdAt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-21 19:58:12 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:54033: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-21 19:58:44 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:43380: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-21 19:59:04 dovecot_plain authenticator failed for (natord) [102.53.15.17]:40512: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 19:59:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<xccIpRtEMpA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 20:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<tcm7pxtE6M1nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 20:00:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<7XMnqBtE2o1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 20:00:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<soAEqRtE0o+UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 20:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<PTBmqRtEpMQ+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:05:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<LFsOuhtE3qkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 20:06:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<LgKeuxtEOp+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 20:06:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<RA3XvBtEeKho7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 20:07:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OjpfwBtEJoSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 20:07:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<xXiNwBtEIKdAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:09:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<j2LuxxtELuKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 20:10:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ECQ8yxtEooM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 20:10:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cRWlyxtEAKBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:11:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<FU1jzhtEspMv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 20:11:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<mwtnzxtEuLI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:12:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<FWDQ0BtEvtlz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 20:12:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<g8Zn0RtErpI+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-21 20:12:23 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (garnize) [5.185.198.73]:43100: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:14:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<oADB2htEgoGElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 21 20:16:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<P+le4htEnaZBMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 20:16:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ELvO3xtEVps+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 21 20:17:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2liM4xtEHPJBMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 20:17:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<6DOK4xtE0hSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 20:17:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<28FR4xtE+oU5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.167.38
country_id: 3469034
description:
Nov 21 20:23:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.109.167.38, lip=66.85.158.91, TLS, session=<m11w+BtEvL27bacm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.81
country_id: 3469034
description:
Nov 21 20:23:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.137.81, lip=66.85.158.91, TLS, session=<O8um+RtE+KW+WYlR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 20:25:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<Rzlx/xtEAJk+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 20:26:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<Pp0KAxxEkpI+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 20:27:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<P1BECRxEaJ0+PIOK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-11-21 20:28:36 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:57474: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 21 20:28:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<o2GCDBxEbLUjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-21 20:29:06 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:59806: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 20:31:05 host2 sshd[2649055]: Disconnected from invalid user belen 62.60.131.157 port 15440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Nov 21 20:31:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, session=<2kbfFhxEQtDLN4MF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 20:32:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<A2zXGRxEiMI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.206
country_id: 6252001
description:
Nov 21 20:34:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<O2htIBxE7TlAPsXO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Nov 21 20:34:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wHyAIRxEZjFAPsXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 20:34:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<nodJIhxESOdo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 20:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<r8ZbIxxEJK4+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 20:36:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<32uFJxxEKJVnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 20:36:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<aVqCKBxEFOikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 20:36:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<WID7KBxEXsyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 20:39:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<ByCwMhxEJuJn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:41:07 host2 sshd[2655427]: Disconnected from invalid user vincent 198.46.249.175 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:42:18 host2 sshd[2656044]: Disconnected from invalid user steam 187.62.87.27 port 51160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:42:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ehRRPxxEJNaElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:42:58 host2 sshd[2656334]: Disconnected from invalid user vincent 161.132.50.86 port 48580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 20:43:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<X1gcQBxE3toI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:43:29 host2 sshd[2656581]: Disconnected from invalid user wms 103.154.216.188 port 52008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:43:35 host2 sshd[2656620]: Disconnected from invalid user uat 198.46.249.175 port 35386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 20:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<7yOfQhxERlqnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:44:03 host2 sshd[2656910]: Disconnected from invalid user acct 51.222.206.109 port 54716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:44:45 host2 sshd[2657380]: Disconnected from invalid user postgres 198.46.249.175 port 60908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:44:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ia8fRhxEeJBz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 20:46:42 host2 sshd[2659943]: Disconnected from invalid user belen 62.60.131.157 port 47425 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:47:11 host2 sshd[2660370]: Disconnected from invalid user uat 103.100.211.35 port 58160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:47:43 host2 sshd[2660585]: Disconnected from invalid user nexus 103.154.216.188 port 48846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 20:47:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<h9sbURxE9JRnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:48:52 host2 sshd[2661246]: Disconnected from invalid user josh 187.62.87.27 port 46212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:48:15 host2 sshd[2660924]: Disconnected from invalid user testuser 198.46.249.175 port 35116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:49:10 host2 sshd[2661425]: Disconnected from invalid user josh 103.154.216.188 port 47790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:49:26 host2 sshd[2661670]: Disconnected from invalid user admin 161.132.50.86 port 36216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:49:34 host2 sshd[2661741]: Disconnected from invalid user whatever 198.46.249.175 port 43190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:49:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<nMDfVxxEpoFz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:50:25 host2 sshd[2662350]: Disconnected from invalid user testuser 51.222.206.109 port 36990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:50:30 host2 sshd[2662374]: Disconnected from invalid user acct 187.62.87.27 port 57610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:50:39 host2 sshd[2662423]: Disconnected from invalid user postgres 103.100.211.35 port 40104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:50:42 host2 sshd[2662469]: Disconnected from invalid user amir 161.132.50.86 port 46118 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Nov 21 20:51:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K/CxXBxEWitBMQGO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 20:51:59 host2 sshd[2663338]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Nov 21 20:51:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vHcWXRxEZCS4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Nov 21 20:51:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YHbDXRxEwEJBMQGO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:51:39 host2 sshd[2663023]: Disconnected from invalid user milad 51.222.206.109 port 39330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.55.113
country_id: 3469034
description:
Nov 21 20:52:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.82.55.113, lip=66.85.158.91, TLS, session=<261JXxxEObyqUjdx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:51:55 host2 sshd[2663250]: Disconnected from invalid user tester 161.132.50.86 port 51674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:53:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<2HvIYxxEUGEv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.193
country_id: 3469034
description:
Nov 21 20:52:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.193, lip=66.85.158.91, TLS, session=<0UiJYBxECbexLGDB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 20:53:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ayw8ZBxEfKc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.80
country_id: 99237
description:
Nov 21 20:53:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=65.20.129.80, lip=66.85.158.91, TLS, session=<hOqNZBxEPNlBFIFQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<0C+QZBxE3jcv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.222
country_id: 6252001
description:
Nov 21 20:53:46 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.222, lip=66.85.158.92, session=<5EhKZhxEquqTuYXe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 21 20:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Xz2hZhxEbsKl6Er8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.239.241.49
country_id: 3175395
description:
Nov 21 20:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=109.239.241.49, lip=66.85.158.91, TLS, session=<EbOgZRxEeuht7/Ex>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.255.211
country_id: 2921044
description:
Nov 21 20:53:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.255.211, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<IK2EZBxED2GG0f/T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:54:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<WCtFaRxEjKsrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:55:58 host2 sshd[2666692]: Disconnected from invalid user testuser 103.100.211.35 port 59220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 20:57:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<YsDbcRxEfstAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:56:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<AxmUbhxE3NQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:57:16 host2 sshd[2667530]: Disconnected from invalid user milad 187.62.87.27 port 49126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:57:45 host2 sshd[2667808]: Disconnected from invalid user iot 103.100.211.35 port 59464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 21:01:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<zIoVgBxEsJGYNbyQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.11.169
country_id: 597427
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.98.11.169 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 21:02:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<xgt7hRxE6pcXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.11.169
country_id: 597427
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 141.98.11.169 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 21:04:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<yN3cjRxE/r6l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-21 21:05:30 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:57504: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-21 21:05:43 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:50172: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 21 21:06:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<z7q4lBxEyp64affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 21:06:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<uNQPlRxEZJ1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 21:06:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<T/oPlRxEZNp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 21 21:07:13 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<kx9ulhxEjj64affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 21:07:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<oLLKlxxEaoU+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 21:08:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<0CBGmRxEoNdnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 21:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<aAfJmxxECKI+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 21:08:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ogYCnBxEuo+UcQQF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 21:09:16 host2 sshd[2675543]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 21:09:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<BPPcnxxEbApniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:10:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<RyqfoBxEloKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 21:11:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Cb+KpBxEwiwvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 21:13:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<U56QqxxEJu5o7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 21:14:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<xxUasRxEKug5gL/H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 21:15:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54645: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 21:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<ImY3thxE3ppnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:17:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<opmOuxxEDotz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 21:17:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<jUqvvBxExJEI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:18:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<8TncvxxEDuyTuYUq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-21 21:18:51 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:58942: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:19:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 97 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Al3SwRxEPN2TuYUq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 21:19:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<TCnEwBxEJOWkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2025-11-21 21:19:09 dovecot_login authenticator failed for ([49.124.159.186]) [49.124.159.186]:59902: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.184.10
country_id: 732800
description:
Nov 21 21:21:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=77.76.184.10, lip=66.85.158.91, TLS, session=<BxfkyRxEBcVNTLgK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:21:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<EhsOyBxELpCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 21:21:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<iHHbyBxEptU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 21 21:21:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<nMIHyhxEjo4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 21:22:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<6fJqyxxEjJ1nmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-21 21:21:14 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:35460: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-21 21:21:28 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:33218: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.72
country_id: 953987
description:
Nov 21 21:22:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.72, lip=66.85.158.91, TLS, session=<iDMIyxxEa6tmgTlI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 21:22:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<z17LzBxEJMuWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:25:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS, session=<NUUe1hxEeu6TuYUq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-21 21:26:26 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11994: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:26:53 host2 sshd[2686273]: Disconnected from invalid user dockeruser 24.232.50.5 port 33038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 21:27:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<JDIS3RxEGtRn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 21:27:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<RfiY3RxEAK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 21:27:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<o6EM4BxE7MenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 21:30:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<uF8n6xxElJoI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:31:55 host2 sshd[2689541]: Disconnected from invalid user bot 24.232.50.5 port 42326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:33:33 host2 sshd[2690756]: Disconnected from invalid user joel 24.232.50.5 port 35834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.45
country_id: 3865483
description:
Nov 21 21:33:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.89.45, lip=66.85.158.91, TLS, session=</nZG9BxE3bi+tVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.108
country_id: 3175395
description:
Nov 21 21:34:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.179.108, lip=66.85.158.91, TLS, session=<fleH9RxE2L+5RLNs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 21:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<NLpH+xxE6Lsv7YNh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:35:14 host2 sshd[2691979]: Disconnected from invalid user ubuntu 24.232.50.5 port 59996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 21:36:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<3Ifn/RxE0J8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.148
country_id: 3469034
description:
Nov 21 21:38:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.209.249.148, lip=66.85.158.91, TLS, session=<wTHrBR1EmYq60fmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.209
country_id: 3469034
description:
Nov 21 21:39:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=190.89.136.209, lip=66.85.158.91, TLS, session=<qw6BCB1ER7++WYjR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:40:03 host2 sshd[2698149]: Disconnected from invalid user felix 24.232.50.5 port 57838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:40:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<KqFeDR1ErsNz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 21:41:36 host2 sshd[2709414]: Disconnected from invalid user jana 62.60.131.157 port 56023 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 21:42:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<K5zqEx1EpqQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 21:43:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<2wS+GB1EeIuYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 21:43:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<mdO4GB1ExLk+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 21 21:43:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tpYOGR1EBAil6Er8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 21:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iwsoGR1E4LYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 21:44:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<p1zsGR1EesNnOJRs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.130
country_id: 6252001
description:
Nov 21 21:45:06 host2 pure-ftpd[2712405]: (?@198.235.24.130) [INFO] New connection from 198.235.24.130


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:45:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ucFCIB1E/qxz8UML>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.188.44
country_id: 2802361
description:
Nov 21 21:47:40 host2 pure-ftpd[2714569]: (?@34.140.188.44) [INFO] New connection from 34.140.188.44


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 21:48:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</IbCKh1ExLql6LP6>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-11-21 21:49:07 1vMTqk-0000000BOJ0-0bSr <= choulwon.kim@kunhwamc.com H=(mail0.puellarium.com) [155.94.193.182]:33969 P=esmtps X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no S=10121 id=20251121111824.63FE37820166CC7E@kunhwamc.com T="Authentication error in info@ceylondigest.com on 11/21/2025 11:18:24 a.m." for info@ceylondigest.com


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 21:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<1JokLB1EarFAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:50:03 host2 sshd[2716306]: Disconnected from invalid user pz 164.92.106.89 port 34706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<fYctMR1Eyt6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 21:52:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<8TPmNh1ExrAFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 21:52:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<GJmPOB1ELKtn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 21:52:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<I3FdOR1EnRQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 21:54:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<dzahPR1EBIp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.206
country_id: 690791
description:
Nov 21 21:54:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=37.221.147.206, lip=66.85.158.91, TLS, session=<YITcPB1Eqp8l3ZPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Nov 21 21:53:20 host2 sshd[2718474]: Disconnected from invalid user vin 179.33.210.213 port 36992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 21:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<yhBrOx1EGORnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:53:42 host2 sshd[2718757]: Disconnected from invalid user joel 164.92.106.89 port 45332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.226
country_id: 953987
description:
Nov 21 21:53:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=102.129.56.226, lip=66.85.158.91, TLS, session=<eVCUOx1EStZmgTji>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 21:54:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<D7XwPx1ENMGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 21:54:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<y6uXQB1EULpo7CMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:54:51 host2 sshd[2720314]: Disconnected from invalid user kibana 164.92.106.89 port 56706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 21:56:57 host2 sshd[2721836]: Disconnected from invalid user jana 62.60.131.157 port 58207 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-21 21:57:01 dovecot_plain authenticator failed for (buffint) [178.250.191.189]:44556: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 21:56:17 host2 sshd[2721448]: Disconnected from invalid user deploy 95.0.252.5 port 34696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 21:57:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XMj6Sh1EzAVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 21:58:52 host2 sshd[2723071]: Disconnected from invalid user runner 95.0.252.5 port 39910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:59:17 host2 sshd[2723319]: Disconnected from invalid user ram 164.92.106.89 port 38932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Nov 21 22:00:11 host2 sshd[2724088]: Disconnected from invalid user admin 179.33.210.213 port 50484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 22:01:25 host2 sshd[2724870]: Disconnected from invalid user payment 95.0.252.5 port 57146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 21 22:02:57 host2 pure-ftpd[2725733]: (?@198.235.24.207) [INFO] New connection from 198.235.24.207


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 22:02:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<fgQrWx1ECs+kXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 21 22:02:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: read(size=713) failed: Connection reset by peer, session=<LhdbWx1EcutChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ImhAXB1EaJuElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 22:02:42 host2 sshd[2725615]: Disconnected from invalid user admin 95.0.252.5 port 41342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.196
country_id: 6252001
description:
Nov 21 22:04:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.196, lip=66.85.158.92, session=<qJGuYR1E/atAPpzE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:04:11 host2 sshd[2726862]: Disconnected from invalid user rke 103.226.139.207 port 52688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 21 22:04:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<na5PYh1EdoZAPpzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 22:05:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Z/wmZR1EZrI+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 22:05:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<rmS4Zx1EhMhnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:07:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<O1XmbR1EwL8I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 22:07:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<TgQ4bx1EEuk5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:08:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<5nTdch1EYK9z8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 22:09:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<p1shdh1EdvanYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:09:32 host2 sshd[2730325]: Disconnected from invalid user firewall 103.226.139.207 port 40404 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.152
country_id: 6252001
description:
Nov 21 22:09:39 host2 pure-ftpd[2730420]: (?@64.62.197.152) [INFO] New connection from 64.62.197.152


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 21 22:09:45 host2 sshd[2730451]: Disconnected from invalid user webuser 123.58.212.64 port 46990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:10:56 host2 sshd[2731740]: Disconnected from invalid user move 103.226.139.207 port 35540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 22:10:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ete+dx1EktGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 22:10:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<NRsbeB1EIrNnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 22:13:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<bcj2hB1EvqM+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:13:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<fgoOhR1EtMxz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 21 22:14:23 host2 sshd[2733859]: Disconnected from invalid user myuser 123.58.212.64 port 34800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:16:00 host2 sshd[2734841]: Disconnected from invalid user joao 192.227.128.3 port 44984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 22:16:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<xBeIjR1EROlAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 22:21:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<fzkhoR1EDuVn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-21 22:22:00 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37064: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 22:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<GYyKnh1EbpYv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:21:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<yoUrnx1ErsgI3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-21 22:22:28 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:38432: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 22:23:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<WEVMph1E5u2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-21 22:26:44 dovecot_plain authenticator failed for (flophotity) [12.150.243.22]:39681: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.23.239.149
country_id: 6252001
description:
Nov 21 22:26:48 host2 pure-ftpd[2742480]: (?@52.23.239.149) [INFO] New connection from 52.23.239.149


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:31:04 host2 sshd[2745418]: Disconnected from invalid user yuriy 192.227.128.3 port 49372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 22:30:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<76D3vh1EiuM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 22:30:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<yE5mvx1EZr4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 22:31:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<KjCmxB1ErtgrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:32:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<88UNyB1EKpSElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 22:32:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qjOuyB1EPqI+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-11-21 22:33:09 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:55150: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:33:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<XB/2yx1E6cai2JaC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.118
country_id: 1269750
description:
2025-11-21 22:34:34 dovecot_login authenticator failed for ([128.185.166.65]) [182.95.222.118]:38812: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:34:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OMsh0B1EguGi2JaC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 22:34:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GOnvzR1EGq+l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-21 22:35:27 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:60999: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 22:36:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hOyj1B1EmfcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 22:37:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Hc0v2R1EArln76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 22:37:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Uasa2h1E9MZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 22:37:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<3jtr2h1EqNpo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:37:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ommM2B1ErMtz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:38:32 host2 sshd[2749609]: Disconnected from invalid user murad 192.227.128.3 port 42656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 22:39:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<KNUm3x1E0qJnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:40:24 host2 sshd[2750743]: Disconnected from invalid user daniel 192.227.128.3 port 45070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 22:41:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<gAN85h1E+us+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 22:41:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<SmMS5x1ERItAF4KF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:41:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS, session=<6dse6B1EwPai2JaC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 22:42:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QEFa6R1ECph2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 22:42:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<2K4j6h1ErK6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:44:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<s1pf8x1EasGElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 22:45:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<mUsu9R1E2LKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 22:45:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<crz79R1EoB1niu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 22:46:50 host2 sshd[2754974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 22:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<A3v0CB5EluxnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 22:51:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<qdSXDB5EwskXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 22:52:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ceb2Dh5EPk2nYwhf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 22:56:15 host2 sshd[2761882]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 22:55:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<1eWJGh5EYJk+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 22:57:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xk/fIR5EhoqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:58:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<Ec4jJR5EHu4I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 22:59:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ED0OKB5EjpM5gL/H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:00:23 host2 sshd[2764356]: Disconnected from invalid user ts3server 71.70.164.48 port 49470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.208
country_id: 6251999
description:
Nov 21 22:59:53 host2 sshd[2763911]: Disconnected from invalid user devuser 158.69.194.208 port 56233 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 21 23:01:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<RAxCLh5E4tNHBpKC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.208
country_id: 6251999
description:
Nov 21 23:02:03 host2 sshd[2765212]: Disconnected from invalid user monitor 158.69.194.208 port 54866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.97
country_id: 690791
description:
Nov 21 23:02:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.221.139.97, lip=66.85.158.91, TLS, session=<ixl/MB5E4rgl3Yth>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.79.251.53
country_id: 3469034
description:
Nov 21 23:01:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=170.79.251.53, lip=66.85.158.91, TLS, session=<ShenLh5Eh6OqT/s1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 23:04:02 host2 sshd[2767084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:03:57 host2 sshd[2766962]: Disconnected from invalid user autrede 71.70.164.48 port 50845 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:05:18 host2 sshd[2767749]: Disconnected from invalid user user 45.78.201.131 port 35008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 23:06:39 host2 sshd[2768768]: Disconnected from invalid user aja 62.60.131.157 port 29455 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 23:08:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<6RuXSB5ELtCYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 23:07:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<fINlRR5E0Asv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 23:08:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<+cbpSB5EeoVAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.50.35
country_id: 2963597
description:
Nov 21 23:10:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=37.203.50.35, lip=66.85.158.91, TLS, session=<GpcYTh5ELoklyzIj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:11:01 host2 sshd[2771413]: Disconnected from invalid user incoming 71.70.164.48 port 47122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.34
country_id: 3175395
description:
Nov 21 23:10:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=195.177.113.34, lip=66.85.158.91, TLS, session=<rD0nTx5EdqLDsXEi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 23:10:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<VV4hUB5EcKVnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-21 23:13:28 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:33530: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-11-21 23:13:15 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:34530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:15:25 host2 sshd[2773871]: Disconnected from invalid user activemq 152.32.172.161 port 59706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 23:16:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<8EYvZh5EKuyElIx5>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:32 host2 sshd[2775604]: Disconnecting authenticating user root 103.156.219.39 port 54495: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:32 host2 sshd[2775604]: error: maximum authentication attempts exceeded for root from 103.156.219.39 port 54495 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 23:18:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<DmhBbB5EhJpn9Sd0>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:43 host2 sshd[2775665]: Disconnecting authenticating user root 103.156.219.39 port 54575: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:43 host2 sshd[2775665]: error: maximum authentication attempts exceeded for root from 103.156.219.39 port 54575 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:20:16 host2 sshd[2776769]: Disconnected from invalid user kale 71.70.164.48 port 44268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 23:21:11 host2 sshd[2777486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 23:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<wmqwdh5EuICl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 23:20:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<f6FKdB5EXsYrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:21:05 host2 sshd[2777438]: Disconnected from invalid user vpn 152.32.172.161 port 54788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 23:22:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<mWu1eR5E4OormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 23:22:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<71wiex5EmOMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 23:23:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<Yu7EfB5EvIBo7CMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-21 23:23:25 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:47514: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-21 23:23:42 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:58252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 23:23:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<OIJtfh5EUIs+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:23:54 host2 sshd[2779054]: Disconnected from invalid user mastodon 152.32.172.161 port 48424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:25:14 host2 sshd[2779863]: Disconnected from invalid user ts3 152.32.172.161 port 33174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 23:26:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Sxrkhh5E2sZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 23:27:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<gYkEix5EtItnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 23:29:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<vTuclB5EysGElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 23:31:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<uiJvmR5EisZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 23:31:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<jjyemR5EyJ2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 23:32:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<jf1lnh5ECN6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 23:33:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<vcEZox5E4pVAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:34:20 host2 sshd[2786240]: Disconnected from invalid user emo 45.78.201.131 port 43790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.236
country_id: 2635167
description:
Nov 21 23:34:42 host2 pure-ftpd[2786560]: (?@87.236.176.236) [INFO] New connection from 87.236.176.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 23:36:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</nZhqx5E3Btniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:36:55 host2 sshd[2788830]: Disconnected from invalid user autrede 45.78.201.131 port 33454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 23:39:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<ss4Nth5EfOFnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 23:39:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iFCqth5EmnynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 23:41:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<CMGOvR5EHL9nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 23:46:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<b87rzx5E7o6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 23:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<UFom1R5ExoM+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 23:51:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Dz164B5EQqo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 23:54:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<sIDA7R5E+teYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 23:55:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<lC248R5E1ogv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.49
country_id: 3469034
description:
Nov 21 23:56:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=187.120.77.49, lip=66.85.158.91, TLS, session=<mUpB8h5Erpi7eE0x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.138.135
country_id: 99237
description:
Nov 21 23:56:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.138.135, lip=66.85.158.91, TLS, session=<Rp+V8x5EE5NBFIqH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 23:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<NyiL9h5ErKs5gL/H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Nov 21 23:58:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6Qmn+R5EzszN0h/c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 23:59:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Bltt/R5E/OA+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 21 23:59:24 host2 sshd[2805440]: Disconnected from invalid user admin 2.57.121.112 port 58651 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.97.71
country_id: 6252001
description:
Nov 22 00:00:12 host2 pure-ftpd[2806280]: (?@135.119.97.71) [INFO] New connection from 135.119.97.71


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:01:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<fMbDBR9EkpdAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 00:00:45 host2 sshd[2806654]: Disconnected from invalid user saige 62.60.131.157 port 36624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:02:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<fSqbCB9EToWElIx5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.252
country_id: 6252001
description:
Nov 22 00:05:09 host2 pure-ftpd[2810053]: (?@45.79.207.252) [INFO] New connection from 45.79.207.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:05:48 host2 sshd[2810410]: Disconnected from invalid user gast 103.153.190.105 port 57256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-22 00:06:17 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:51810: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-22 00:06:43 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:40825: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 00:09:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<M67VIB9Ez84vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 00:09:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<G3jxIR9EkIxo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 00:10:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2E2+Jh9ElMQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 00:11:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oC7HKB9EaJel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 00:12:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<uCo9LB9EyOErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 00:13:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<1Kb9Lh9EkNZnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 22 00:12:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<y1sKLh9E5LuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 00:14:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<BZD9Mx9EkI5n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 00:15:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<YF3kNh9EuNRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:15:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<zlsNNx9E2MiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 00:15:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<t3GhNh9EkKpnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-22 00:16:38 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:52835: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-22 00:16:55 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49604: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.101
country_id: 798544
description:
Nov 22 00:18:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.97.101, lip=66.85.158.91, TLS, session=<cbFqQR9EF7Sy22Fl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 00:17:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ItDePx9EnrmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.157
country_id: 3469034
description:
Nov 22 00:18:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.72.78.157, lip=66.85.158.91, TLS, session=<jmzxPx9ErqOxSE6d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 00:19:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<qF5VRB9EUsB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.176
country_id: 3469034
description:
Nov 22 00:20:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=177.44.96.176, lip=66.85.158.91, TLS, session=<gvEFSB9EJqCxLGCw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.51
country_id: 3277605
description:
Nov 22 00:19:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=188.246.73.51, lip=66.85.158.91, TLS, session=<Zh23RR9EM6W89kkz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 00:23:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=</wGRUx9EGp6UcQQF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:23:45 host2 sshd[2822864]: Disconnected from invalid user linda 103.153.190.105 port 59680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:25:16 host2 sshd[2824463]: Disconnected from invalid user admin 165.154.205.128 port 52590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:26:35 host2 sshd[2825548]: Disconnected from invalid user appuser 27.100.36.42 port 33936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 00:26:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<qx2SXx9EJgZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 00:26:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qerAXx9E6P2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:27:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<qPG6YR9EWstAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 00:27:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<S9K9Yx9EQMpnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:28:30 host2 sshd[2826776]: Disconnected from invalid user dinesh 103.153.190.105 port 51239 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.154.238
country_id: 1168579
description:
Nov 22 00:29:33 host2 sshd[2827491]: Disconnected from invalid user jay 121.52.154.238 port 49802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:29:41 host2 sshd[2827569]: Disconnected from invalid user jay 103.59.94.155 port 48392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:29:43 host2 sshd[2827638]: Disconnected from invalid user vinay 27.100.36.42 port 51454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:31:08 host2 sshd[2828709]: Disconnected from invalid user prowlarr 103.59.94.155 port 59250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:31:25 host2 sshd[2828905]: Disconnected from invalid user raja 27.100.36.42 port 52274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:30:53 host2 sshd[2828569]: Disconnected from invalid user eren 165.154.205.128 port 35124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:32:33 host2 sshd[2829761]: Disconnected from invalid user viewer 103.59.94.155 port 37782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:32:57 host2 sshd[2830031]: Disconnected from invalid user postgres 103.153.190.105 port 39196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:33:20 host2 sshd[2830321]: Disconnected from invalid user user9 27.100.36.42 port 53118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 22 00:33:48 host2 sshd[2830581]: Disconnected from invalid user Test 147.50.227.142 port 45722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 00:34:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gSzKfB9E8J8XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:35:04 host2 sshd[2831597]: Disconnected from invalid user devel 165.154.205.128 port 59786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:35:12 host2 sshd[2831765]: Disconnected from invalid user admin 103.59.94.155 port 50684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 00:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<f6uUfh9EFpyWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:36:22 host2 sshd[2832527]: Disconnected from invalid user vinay 165.154.205.128 port 53404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:38:00 host2 sshd[2833649]: Disconnected from invalid user danya 27.100.36.42 port 55614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:39:04 host2 sshd[2834388]: Disconnected from invalid user steve 165.154.205.128 port 35256 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 00:39:39 host2 sshd[2834792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 22 00:41:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<kR3JlB9ErMuYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-22 00:41:41 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:51524: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-22 00:42:06 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:34174: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 22 00:44:03 host2 sshd[2837499]: Disconnected from invalid user alex 147.50.227.142 port 57024 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 22 00:44:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<W3eonh9EfF5ChJl6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.157
country_id: 6252001
description:
Nov 22 00:43:44 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.157, lip=66.85.158.91, session=<93HBnB9ELINC5DWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 00:43:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<h4IDnR9EJNFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 00:44:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LGcioB9Evrk+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 22 00:44:56 host2 pure-ftpd[2838064]: (?@167.94.146.63) [INFO] New connection from 167.94.146.63


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 00:45:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<e5kqoR9EYM4v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:47:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ECWGqx9EEpWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.218
country_id: 99237
description:
Nov 22 00:48:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=65.20.153.218, lip=66.85.158.91, TLS, session=<UESoqx9EhcRBFJna>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.140
country_id: 690791
description:
Nov 22 00:47:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=176.103.7.140, lip=66.85.158.91, TLS, session=<CD1kqh9Ey9uwZweM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 00:55:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<f68sxR9E1MQ5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:55:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<V0g7xh9ESqpAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 00:55:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<yRqoxx9EmrovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 00:55:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<Rzy4xx9EarRo7CMU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 00:56:37 host2 sshd[2846195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 00:59:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<j7VK1B9ENo2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:01:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<oIaR2h9E2uMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<RiVN2h9EMteElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 01:03:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<fyCv4h9EkuZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:02:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<A1AM4B9EIOkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 01:04:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<spUl5h9EluJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 01:04:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<4oG55h9EkpU+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 01:04:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<wTGz5R9ESMSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 01:07:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<q2/Q8B9EaIp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Nov 22 01:08:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=173.255.221.189, lip=66.85.158.91, session=<tBh/9B9E4bWt/929>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 01:08:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Y1ih9h9EqO1n9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 01:11:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 01:13:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<lVUYBiBE7MqUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 01:13:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<wIPoBiBEFO6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 01:14:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<PS8TDCBEsMpnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.87
country_id: 3469034
description:
Nov 22 01:16:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=187.120.72.87, lip=66.85.158.91, TLS, session=</c4DDyBEldu7eEhX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 01:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<AumRECBE0IZnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.70.38.61
country_id: 3865483
description:
Nov 22 01:16:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=146.70.38.61, lip=66.85.158.91, session=<idr2ECBEjTmSRiY9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.123
country_id: 2215636
description:
Nov 22 01:16:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=169.239.118.123, lip=66.85.158.91, TLS, session=<HrhFECBEQ9Cp73Z7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 01:16:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<cn04ESBEoR1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.126
country_id: 3469034
description:
Nov 22 01:17:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.120.73.126, lip=66.85.158.91, TLS, session=<mLHxFCBE++i7eEl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Nov 22 01:17:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<IlwqFiBEsLO5xQmz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 01:21:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<KagTIiBEcqJAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 01:24:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<H1GZLSBEtKSWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Nov 22 01:26:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.239, lip=66.85.158.92, session=<L/fjNiBEPPjN0h/v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 22 01:28:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<04sIPCBE6NOYNbyQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.79.181.157
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.79.181.157 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.81.172
country_id: 6252001
description:
Nov 22 01:32:26 host2 pure-ftpd[2872207]: (?@47.251.81.172) [INFO] New connection from 47.251.81.172


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:33:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<EBbGTSBEUoyElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 01:34:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<7g1yUiBEeswv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 01:34:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<8KljUyBECvkv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.102
country_id: 6252001
description:
Nov 22 01:37:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.36.102, lip=66.85.158.91, session=<JvlYXiBEromlmiRm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.36.102
country_id: 6252001
description:
Nov 22 01:37:53 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.36.102, lip=66.85.158.91, session=<pbJpXiBEPoqlmiRm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 01:40:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<vcqOaCBEIpU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 01:41:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<UCbFbCBEeaUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 01:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<U6fvbCBEJJ9o7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 01:42:04 host2 sshd[2879441]: Disconnected from invalid user admin 2.57.121.112 port 53861 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-22 01:44:01 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:34640: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-22 01:44:20 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:56935: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.216
country_id: 3175395
description:
Nov 22 01:45:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.234.216, lip=66.85.158.91, TLS, session=<y4EKeSBExZerFurY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.16.146.222
country_id: 1269750
description:
Nov 22 01:46:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.16.146.222, lip=66.85.158.91, TLS, session=<Py40eiBEXYlnEJLe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 01:46:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<bxF/eyBEhMhnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:46:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<gUH7eyBEusiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 01:46:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<W/ajfiBE6N2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 01:49:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<ke4nhiBEur1AF4KF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-11-22 01:50:16 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:38178: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 01:50:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<gF50jCBEqM+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 01:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<xUeujCBEGOJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:51:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<E611jSBEWsIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:52:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<9z4AkyBENOsrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 01:52:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<R6MikyBEKLs5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 01:52:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<SOEskyBEFIJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 01:55:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<UaR4nCBESLh2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 01:57:00 host2 sshd[2891682]: Disconnected from invalid user davin 62.60.131.157 port 64755 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 01:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<75mtoyBE3uM+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.151
country_id: 3175395
description:
Nov 22 01:58:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.235.151, lip=66.85.158.91, TLS, session=<BFNdpSBEDeCrFuuX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 22 01:58:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<9j14piBEYa+ynG0e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 01:59:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<SmzCqyBEmLqnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 01:59:17 host2 sshd[2892965]: Disconnected from invalid user visitor 38.105.25.194 port 53136 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 02:00:31 host2 sshd[2893912]: Disconnected from invalid user zbx 38.105.25.194 port 45712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 02:02:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<1RvatyBE6s1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<uwLRuCBEVoGUcQQF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 22 02:03:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<tjTcuSBEHJFChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-22 02:04:34 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 22 02:03:37 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, session=<WTxtuiBErudChJl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:04:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<0bIhviBEmtw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 02:04:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<kSPkviBEQIpnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 02:05:10 host2 sshd[2897067]: Disconnected from invalid user bogdan 38.105.25.194 port 55034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:06:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<NepkwyBE2jdniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.205
country_id: 6252001
description:
Nov 22 02:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.205, lip=66.85.158.91, session=<KaWh1iBEH9lomDTN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.203
country_id: 6252001
description:
Nov 22 02:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.203, lip=66.85.158.91, session=<iRqj1iBE1cJomDTL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.211
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.211, lip=66.85.158.91, session=<YovE1iBEt5ZomDTT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.207
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.207, lip=66.85.158.91, session=<p4vH1iBEP4domDTP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.209
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.209, lip=66.85.158.91, TLS: Connection closed, session=<lo3M1iBEmaBomDTR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.206
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.206, lip=66.85.158.91, session=<WvHI1iBEt79omDTO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.30
country_id: 1643084
description:
Nov 22 02:13:32 host2 sshd[2903284]: Invalid user cloudtourssrilan_travel from 182.8.225.30 port 62200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.30
country_id: 1643084
description:
[2025-11-22 02:13:33 +0530] info [whostmgrd] 182.8.225.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 22 02:14:59 host2 pure-ftpd[2904021]: (?@165.227.134.101) [INFO] New connection from 165.227.134.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.200.102
country_id: 2921044
description:
Nov 22 02:14:59 host2 pure-ftpd[2904018]: (?@164.92.200.102) [INFO] New connection from 164.92.200.102


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 02:24:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<76GNBiFEhp0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 02:27:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<e64fDyFEYLwXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.117
country_id: 6252001
description:
Nov 22 02:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.106.117, lip=66.85.158.91, session=<CP0OFCFE0sAUQGp1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:31:52 host2 sshd[2914284]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:32:22 host2 sshd[2914486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 02:32:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<FNFVICFE2JOElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-22 02:33:11 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:53287: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 22 02:33:16 host2 sshd[2914934]: Invalid user visionsolutionshospital from 154.219.110.64 port 48064


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-22 02:33:24 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:40946: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 22 02:35:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<piHjKiFEfqiUcdZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:36:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1oLlLiFETrA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:36:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<F0gIMCFE4M4+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:39:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1PEJOSFEXIw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.49.251
country_id: 6252001
description:
Nov 22 02:38:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.49.251, lip=66.85.158.92, session=<3vrINSFEtKqsyjH7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Nov 22 02:38:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<27nlOCFEYtyTuYRY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 02:40:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<PbScPyFEMJE+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:43:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<sKazRyFESsg+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 02:44:54 host2 sshd[2921812]: Disconnected from invalid user admin 2.57.121.112 port 22784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:45:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TO7JTyFE9wRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 02:46:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TGr2USFE2uVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:48:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zJlUWSFEiuc+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:48:45 host2 sshd[2924558]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:48:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<aJNpWiFEPs2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 02:48:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<nF1CWyFEilKnrHj2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-22 02:48:45 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:43066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:48:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<blapWyFEMN8zTd4Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-22 02:48:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 02:48:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<J0xrWSFEbN1tbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 02:49:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<RXHIXyFEML/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 02:49:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DrMOXSFE5qorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:49:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<heZmXSFEGJozTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 02:49:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<gDyyXSFEQrA+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 02:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<fdOyXyFEqtto7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 02:50:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FRX5YiFESnRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.45
country_id: 3175395
description:
Nov 22 02:50:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.197.9.45, lip=66.85.158.91, TLS, session=<70+0YCFENp25xQkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.235
country_id: 798544
description:
Nov 22 02:50:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=178.219.105.235, lip=66.85.158.91, TLS, session=<GbrGYSFEEt2y22nr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:52:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KVlIaiFEqAZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 02:53:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<DMqdbCFEyq9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 02:56:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<MRmfdSFEEs+nrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 02:55:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<guj7cyFEeo9tbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:55:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<agrzdCFEZJSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 02:55:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1qxCdSFELOs+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:56:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<cwQgdiFEdNQzTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 02:56:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Ip+TdyFEUtArpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 02:57:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<VJFueiFEPtzIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 02:57:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<HNcneiFERMlo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 02:58:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kt9qfSFEwJ1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 02:59:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<qnafgyFE5wi2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.190
country_id: 6290252
description:
Nov 22 03:00:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=91.234.135.190, lip=66.85.158.91, TLS, session=<0ghehCFEOb5b6oe+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 03:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vXLGhSFEAteLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 03:00:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<ODMKhiFEjpwzTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.75
country_id: 732800
description:
Nov 22 03:00:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.212.75, lip=66.85.158.91, TLS, session=<hL12hSFEtt65/9RL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 03:00:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ArbThCFEauy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 22 03:01:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hWpAiiFEZpOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 03:01:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<kABgiiFEktenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 03:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qKYljSFEnrs+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 03:02:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<ZRmhjiFE5so+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 03:03:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<u614jyFEJOSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:04:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<+8lFkyFEyMUv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 03:05:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rQlklyFE/OfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 22 03:05:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HwcymCFEztAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 03:05:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<jB43mCFE4qk+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-11-22 03:05:54 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:59141: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 03:06:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<VVq6myFEhIov+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 03:06:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<Sm3emyFEdoVnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-22 03:06:50 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:45838: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 03:06:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<KSjjnCFEzqEzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 03:08:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<L8GqoCFE2oxrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 03:07:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yVgqnyFERocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:07:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<9ONvoCFEQpUv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 03:08:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<NghqoSFE2KMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 03:08:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<fuCdoiFEOpNn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 03:09:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<UNt8pyFEIrE+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 03:10:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<P/EnqSFEPLY+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 03:10:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<o/QhqyFE+tJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 03:12:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<pCHnriFEIMY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.43
country_id: 953987
description:
Nov 22 03:12:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.41.43, lip=66.85.158.91, TLS, session=<tmSosCFEn+lmQCkr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.158
country_id: 953987
description:
Nov 22 03:12:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.33.158, lip=66.85.158.91, TLS, session=<VQlNryFEsJVmQCGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 03:14:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<rLQNtyFEvLwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 22 03:15:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<MA/IuyFEwt2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:16:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<KWkovSFEtrk+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 03:16:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<s1OfviFEqssI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Nov 22 03:16:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ayuzonelanka.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<l5rNviFEmte8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 03:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<3JtaxCFEQp9nmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-22 03:18:59 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:41880: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 03:19:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xuTWySFEJpsv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 03:20:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZG4RzSFEiwtniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:20:34 host2 sshd[2944706]: Disconnected from invalid user sftp_user 154.219.125.194 port 54750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 03:21:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<aLCB0SFE1p12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 22 03:21:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<qXLV0SFEAtKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 03:21:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<y5Jq0iFEdK4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:22:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Uo3G0iFEAsUv/DJe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:21:09 host2 sshd[2944954]: Disconnected from invalid user soporte 81.170.248.221 port 41636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:22:41 host2 sshd[2945791]: Disconnected from invalid user dspace 81.170.248.221 port 46184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.71
country_id: 6252001
description:
Nov 22 03:22:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kAb41SFEc8/N0h9H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 03:23:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<R57f1iFEINI+PIcd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 22 03:23:17 host2 pure-ftpd[2946094]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 22 03:23:20 host2 pure-ftpd[2946126]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:24:07 host2 sshd[2946554]: Disconnected from invalid user soporte 154.219.125.194 port 39782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 03:24:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<5Y2/2iFEcuOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 03:25:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<a79X3yFElqcv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:25:13 host2 sshd[2947430]: Disconnected from invalid user demo3 154.219.125.194 port 59556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 03:27:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<eW2/5CFE0LM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 03:26:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MtUg4iFEitYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 03:26:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<ty484yFEsJwv+yzS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:27:25 host2 sshd[2949005]: Disconnected from invalid user p 154.219.125.194 port 41588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 03:27:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<gMuk5iFEOMov+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:28:03 host2 sshd[2949398]: Disconnected from invalid user ftpuser 162.241.87.197 port 55862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 03:27:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<TALl5CFEitpnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.146
country_id: 3175395
description:
Nov 22 03:28:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.169.146, lip=66.85.158.91, TLS, session=<IM/t5yFEBZ25D6mS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.219
country_id: 690791
description:
Nov 22 03:28:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.25.219, lip=66.85.158.91, TLS, session=<b6AD6SFEOuuwZxnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 03:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<WmKK6iFEht6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 22 03:29:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<10bS6yFEdtTBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 03:29:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<BM0j7SFEdtE+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 03:29:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GDvj7SFEbIJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 03:29:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<meAX7yFE9Mml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 03:29:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<uo0y7yFEEpmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-11-22 03:30:42 dovecot_login authenticator failed for (31-154-88-152.orange.net.il) [2.55.88.152]:52389: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:30:49 host2 sshd[2951257]: Disconnected from invalid user admin 81.170.248.221 port 39328 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:30:16 host2 sshd[2950954]: Disconnected from invalid user soporte 162.241.87.197 port 51948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:32:28 host2 sshd[2952362]: Disconnected from invalid user scs 162.241.87.197 port 45548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 03:33:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<M48j+yFEOMAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 03:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<gkFnASJERO2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 03:34:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<0KK//yFEQJaUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 03:34:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<RLvT/yFEFKY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 03:34:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<CjTDACJEYNJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 03:35:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<ElEUBCJEiIRtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 03:36:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<M6u0BSJEWIOElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 03:37:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<qoQuCiJE2Oo+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 03:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<vcvaCiJEaIk+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 03:39:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<uOpjDyJErp9n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 03:39:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<Y0B2DyJExDenrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:39:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<F9sVECJERpU+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 22 03:39:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mkZwECJEQKtm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 03:39:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<yVMzESJElpOUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 03:39:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZzVtEiJETtI+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 03:40:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<D/B8EyJE0K8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 03:40:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<9Bx/EyJEhstnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 03:40:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<fGIyFCJERieYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 03:40:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<PqY5FSJEnr4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 03:41:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<EKwHFyJESoEv+yXY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 22 03:41:21 host2 pure-ftpd[2958547]: (?@148.113.211.131) [INFO] New connection from 148.113.211.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 22 03:41:27 host2 pure-ftpd[2958610]: (?@148.113.211.131) [INFO] New connection from 148.113.211.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 22 03:41:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<bJ6fGSJE2NKB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 03:42:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+dyyHCJEWuJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 03:45:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<FLuOJiJENIM5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov 22 03:45:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<S2KuJiJEy8sz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 03:45:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<39VZKCJEvOg+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 03:46:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<aIBtKSJEopVtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 03:46:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<JYoqKyJEPNo+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 03:47:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<r0OPLCJEvsZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 03:48:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9rOLMSJENrII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 03:48:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</fsHMyJERRJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 03:49:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<kKxkNSJEuqgvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 03:49:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<M89aNiJEfpc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 03:51:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<zpN2OiJEZK6qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 03:51:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@agronatureholdings.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<TnsZOyJE8Yy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 03:52:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ffweQCJEyMKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 03:53:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<GkK7QSJEbsYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 03:54:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wC0gRyJEap52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 03:54:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<z2O6RyJEotYvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 03:56:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<JhekTiJEsLBAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 22 03:58:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<YB8sVSJERu4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 22 03:58:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<vqPmVSJEjIkv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:59:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+A4BWiJE+oY+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:00:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<6KsrXCJEDsgv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:01:24 host2 sshd[2977490]: Disconnected from invalid user admin 104.168.117.131 port 52260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:01:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<wq6LYSJEkodnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:02:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<yVxxYiJEuo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:02:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@agronatureholdings.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<10qWYyJE+pJrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:03:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@askinternationalconsortium.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<zlBbaCJEIrxrhr+5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:03:39 host2 sshd[2980013]: Disconnected from invalid user gpu 104.168.117.131 port 37566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:04:41 host2 sshd[2980772]: Disconnected from invalid user myuser 104.168.117.131 port 33124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 04:05:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<T5arbSJESHC2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:05:44 host2 sshd[2981975]: Disconnected from invalid user ir 104.168.117.131 port 58936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 04:05:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Q6W3biJEbnG2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 22 04:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<DDmZcyJEdOIv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:06:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ayuzonelanka.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<SDC/cSJEipRrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:06:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<kSgTciJEJNg+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:06:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<MbuxciJEZKpnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:07:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<mpLMdSJEPoyl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 04:08:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<u6lIeSJETphtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 04:08:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<SOJleSJEzPKnrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 04:08:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VV8JeiJE0Jsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 04:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<MXkCfyJERsySO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 04:10:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<FO86gSJEasul0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Nov 22 04:11:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oBFtgiJEUMnN0h9p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.123
country_id: 3865483
description:
Nov 22 04:11:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=45.238.107.123, lip=66.85.158.91, TLS, session=<V4IBgyJET+Yt7mt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.105
country_id: 690791
description:
Nov 22 04:11:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=176.103.0.105, lip=66.85.158.91, TLS, session=<4wc7hCJEatiwZwBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 04:13:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<f3pGiSJESJg+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:13:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<oOJLiSJE/NJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-22 04:13:08 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38699: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:12:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eqaWhyJEWLM+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-22 04:12:47 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:53794: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:14:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JCbDjiJEVrFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 22 04:14:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<ppyCjyJEUo3Bl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-11-22 04:15:31 dovecot_login authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:65005: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 04:15:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<i3XYkiJEyt0v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-22 04:16:06 dovecot_login authenticator failed for (static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:31754: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 04:16:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<rO46liJEyrqElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-22 04:16:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:52208: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 04:16:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zhCxliJEYop2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-22 04:16:58 dovecot_plain authenticator failed for (paichist) [102.53.15.56]:42168: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Hp/2miJE6udnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 04:18:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Ox/imiJEPpeLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 04:18:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<rx7tnSJE6uGqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 04:18:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HQwpniJEeoIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 04:18:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<T4HwnSJEOtuUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:19:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<rPdfoSJEup+l0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 04:20:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<woeFpCJEjNql0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:21:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<VAv9qCJETOlnoNQc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 04:23:59 host2 sshd[3000652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 04:23:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<syGnriJE9LgvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 04:26:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<zdrauSJEbtyLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 04:28:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ZlM6wCJEwL6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 04:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<3v0awSJEPMRnOJRs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 22 04:28:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.91, session=<NhTBwSJEYOsUQcHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 04:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<NjydyiJE3uZnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 04:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<60umyiJEEIE+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:32:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<F8yUzSJEQLY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 04:33:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<DcdF0SJEyrM+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Nov 22 04:35:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DicH2CJETuW8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.154.166.18
country_id: 1605651
description:
Nov 22 04:34:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=122.154.166.18, lip=66.85.158.91, session=<gkvU1iJEDtZ6mqYS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 04:35:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<PPiO2iJE1OI+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-22 04:36:51 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:47556: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-22 04:37:08 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:39384: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.124.58
country_id: 226074
description:
Nov 22 04:40:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=196.0.124.58, lip=66.85.158.91, TLS, session=<HXAA6SJEMbXEAHw6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:26 host2 pure-ftpd[3014973]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 04:40:55 host2 sshd[3015441]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 04:40:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<rB+/6yJETpgI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-22 04:40:40 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:55024: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:41:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<XYnp7SJEJoov+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:28 host2 pure-ftpd[3014992]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.120
country_id: 3469034
description:
Nov 22 04:40:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.199.120, lip=66.85.158.91, TLS, session=<wXJI6iJE6dOzvcd4>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:32 host2 pure-ftpd[3015147]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 04:41:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<UVkY8CJEuK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.248
country_id: 3469034
description:
Nov 22 04:41:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.53.165.248, lip=66.85.158.91, TLS, session=</a/i7iJE2pCxNaX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.15.98.132
country_id: 3865483
description:
Nov 22 04:42:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=181.15.98.132, lip=66.85.158.91, TLS, session=<mxOV8CJE49S1D2KE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 22 04:42:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yhVc8iJE4oEjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.60
country_id: 6252001
description:
Nov 22 04:43:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7dAs9iJEUNXN0h88>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 04:45:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<IxH8/iJELO4+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 04:46:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<JLppASNELGmnrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov 22 04:47:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dymDAyNEvdMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:49:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<eH7lCSNEnuql0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.83.201.41
country_id: 1819730
description:
Nov 22 04:49:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.83.201.41, lip=66.85.158.91, session=<DrItCyNEbq4vU8kp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:49:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<7TTCCyNEwp0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:49:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<VAJMDSNEIok+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 04:50:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55639: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 04:51:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4eIJESNEDMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 04:50:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<HbexECNEZro+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 04:51:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<CfRNEyNE/Jto7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 04:52:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<i5LvFCNEdqs+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<kNdbFSNEzss+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:53:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<hcEPGCNExJAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 04:53:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<IMOGGyNE7oDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 04:54:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<eGj5GyNEuNMvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:55:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<rNh1HyNExNI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-22 04:57:07 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:41630: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-11-22 04:56:35 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:43835: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-22 04:57:29 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:44130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.154
country_id: 6252001
description:
Nov 22 04:57:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=<97uZKCNELK0SYROa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 04:59:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<rbnbLSNEWOySO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 04:58:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<s9/iLCNEprpAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 04:59:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8aOGMCNEoLM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 05:00:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<0T0rMyNEIEunrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 05:00:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<l7DcMyNElKIzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 05:00:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Ucj+MyNEOr5n76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 22 05:02:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lSWjOiNEfNBHBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:04:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<uDNzPyNElso+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 05:04:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<+CJfQSNEHOE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:05:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<DGBbQyNEPsM+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.42
country_id: 3469034
description:
Nov 22 05:09:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.44.71.42, lip=66.85.158.91, TLS, session=<DcKdUiNEQa+xLEcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.144
country_id: 798544
description:
Nov 22 05:09:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=91.228.33.144, lip=66.85.158.91, TLS, session=<H+nJUyNEYA5b5CGQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 05:10:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<A0NEVyNEnuI+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 22 05:13:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<Oa85YSNEzomUcd0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:15:34 host2 sshd[3041406]: Disconnected from invalid user emilia 156.236.74.199 port 55644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 05:17:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<R3wobyNESq0+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:20:40 host2 sshd[3044426]: Disconnected from invalid user ricardo 156.236.74.199 port 59662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:22:11 host2 sshd[3045408]: Disconnected from invalid user xzh 151.36.128.57 port 6521 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 05:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<yywsfiNEHrA+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.178
country_id: 6252001
description:
Nov 22 05:22:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.117.178, lip=66.85.158.92, session=<XN0KgiNEwqesynWy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:23:05 host2 sshd[3046044]: Disconnected from invalid user proxyuser 156.236.74.199 port 60282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 05:23:08 host2 sshd[3046055]: Disconnected from invalid user admin 2.57.121.112 port 27175 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Nov 22 05:23:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JlUghiNEcNPG6xhN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 05:23:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<G4lJhiNEnug+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.18.253.210
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.18.253.210 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:30:35 host2 sshd[3050879]: Disconnected from invalid user agent 156.236.74.199 port 44506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:32:04 host2 sshd[3051893]: Disconnected from invalid user debian 151.36.128.57 port 6531 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 05:36:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<k9A2syNE3k4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 05:37:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</P9ttiNEUrA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 05:37:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</sTotiNE4r5A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Nov 22 05:36:38 host2 sshd[3055525]: Disconnected from invalid user client 20.193.141.133 port 26112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 05:37:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ki4WtiNENrY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.167
country_id: 798544
description:
Nov 22 05:38:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=78.31.145.167, lip=66.85.158.91, TLS, session=<QARduCNEx6JOH5Gn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 05:38:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0knBuSNEcuOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 05:38:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<zmfcuSNEusYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 05:38:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<84w6uiNEMugv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 05:38:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<uZVeuiNEzuoEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.240
country_id: 690791
description:
Nov 22 05:37:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=176.103.2.240, lip=66.85.158.91, TLS, session=<MJZStyNENoCwZwLw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 05:37:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XraUuCNEDIM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 05:39:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<ttHUvCNEoqIzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:39:10 host2 sshd[3057028]: Disconnected from invalid user ftpuser 138.204.127.54 port 54465 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.207.52.158
country_id: 798544
description:
Nov 22 05:39:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=91.207.52.158, lip=66.85.158.91, TLS, session=<oq0uvSNEQMRbzzSe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 05:38:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<odr8uiNEBHanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 05:38:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<LpoVuyNEWOE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.189.167
country_id: 6252001
description:
2025-11-22 05:40:22 dovecot_plain authenticator failed for (splasm) [75.109.189.167]:52298: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 05:39:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<3GSuviNEcq52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.142
country_id: 3865483
description:
Nov 22 05:39:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=138.0.184.142, lip=66.85.158.91, TLS, session=<wKpVviNEL5uKALiO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 05:39:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<SCcUwCNE2MYrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Nov 22 05:41:27 host2 sshd[3059175]: Disconnected from invalid user terraria 20.193.141.133 port 54887 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:40:30 host2 sshd[3058392]: Disconnected from invalid user ricardo 151.36.128.57 port 6734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 05:40:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hfAWwyNEUNc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 05:40:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<vVQzwyNEwN0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 05:40:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<9goxwyNEZKYv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:41:16 host2 sshd[3059083]: Disconnected from invalid user nk 103.171.85.124 port 42756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-22 05:41:19 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (indly) [67.173.58.47]:55092: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 05:41:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<s+4fxyNEDtov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 05:42:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nbdZyCNETraPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:42:22 host2 sshd[3059798]: Disconnected from invalid user art 138.204.127.54 port 58228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 05:42:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lVi9yCNEiJE+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:43:06 host2 sshd[3060339]: Disconnected from invalid user art 103.171.85.124 port 32894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Nov 22 05:44:16 host2 sshd[3061202]: Disconnected from invalid user art 103.187.147.92 port 42282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 05:43:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ktG1zSNEIOOUcQQF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:43:48 host2 sshd[3060797]: Disconnected from invalid user amir 138.204.127.54 port 45156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 05:43:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<merSzSNE4rYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 05:44:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gaYmzyNEqAZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:44:54 host2 sshd[3061608]: Disconnected from invalid user vpn 103.171.85.124 port 49188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 05:46:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<FGHD1SNEfIVn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:46:13 host2 sshd[3062876]: Disconnected from invalid user oleh 103.179.217.33 port 41160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Nov 22 05:46:17 host2 sshd[3062923]: Disconnected from invalid user cdn 95.85.114.218 port 35378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 05:46:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<n5DL2CNEFrc+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:48:15 host2 sshd[3064869]: Disconnected from invalid user terraria 138.204.127.54 port 34184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 05:47:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uzT12iNE0t2l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:49:04 host2 sshd[3065525]: Disconnected from invalid user minecraft 34.92.146.210 port 50350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 05:49:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<3FPb4yNELKHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 05:50:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ltH95CNEDKRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 05:50:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<g+g65SNE6Mkv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:49:32 host2 sshd[3065888]: Disconnected from invalid user devuser 103.179.217.33 port 48818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:51:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<y2706CNE4LI+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 05:50:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<k1si5yNE9uOSO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Nov 22 05:51:40 host2 sshd[3067712]: Disconnected from invalid user cpd 177.44.220.67 port 54678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 05:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<nG/u6yNEftUI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 05:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<aYX76yNEYO6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 05:52:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<nXoR7iNEGsM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 05:53:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1Tx77yNEPEYvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:52:44 host2 sshd[3068366]: Disconnected from invalid user ts 34.92.146.210 port 35564 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 22 05:54:20 host2 pure-ftpd[3069685]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-11-22 05:53:37 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:49802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-22 05:53:53 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:50114: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:53:56 host2 sshd[3069139]: Disconnected from invalid user tunnel 103.179.217.33 port 50548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 05:53:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jXkS8iNECNVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 05:54:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<KwDa8iNEltAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 05:55:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<3giK9iNESukI04Sw>


