# incident

plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.165.84
country_id: 6252001
description:
Nov 22 22:26:30 host2 pure-ftpd[3775454]: (?@34.224.165.84) [INFO] New connection from 34.224.165.84


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 22:27:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<heel0zFEYoYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 22:27:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3ROJ1DFEkrkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 22:27:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<61/b0jFEYyFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 22:28:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ClpO1jFEZr92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 22:30:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<pnhR3TFEutEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 22:30:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TPep3DFEGs+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 22:31:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<fhdy4TFEdOyUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 22:31:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<VozI4TFEWN5n9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:33:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<i9l86jFEKN8jy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 22:33:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<v50z6TFEnOcEkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 22:34:40 host2 sshd[3780080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 22:34:46 host2 sshd[3780098]: Disconnected from invalid user admin 2.57.121.112 port 40794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:35:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<O5hj7jFEkvAjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov 22 22:35:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.92, session=<1sUR8TFEDrHY2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 22:35:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FFl47zFERG2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 22:35:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<O9N27zFE6Kgv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<8fOw7zFEFukjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 22 22:35:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=</Bmj8DFEtvpBMRRE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 22:35:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<eq7K8DFEjLzIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov 22 22:36:17 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.92, session=<VjDO8jFE+HTY2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 22 22:36:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<apG88jFERKPF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 22:36:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Ic8V8zFEjoA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 22:36:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nQhu9DFETscrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 22:36:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nxmU9DFEHOAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 22:37:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<rUU29zFEwqA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 22:39:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<QbXD/TFE3IM+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 22:39:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<e0zG/jFExkIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 22:40:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ZSIaATJEzJoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 22:40:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tHkFATJECodn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 22:42:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<G0OIBzJEAuwI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:42:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS, session=<y0oTCDJEqPcjy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 22:44:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7wTqDjJEBlKYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.173
country_id: 6252001
description:
Nov 22 22:44:59 host2 pure-ftpd[3786443]: (?@198.235.24.173) [INFO] New connection from 198.235.24.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 22:45:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<W0jmETJEssmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 22:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<zbZNFzJExIWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 22:48:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<iaHRHDJE8JRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 22:47:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<H9j5GTJETsw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 22:47:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<bJSIGjJEUrp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 22:47:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<q2SmGjJEMpIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 22:47:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<+TN1GzJE6qszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 22:47:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3JZSHDJEcLMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 22:47:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Ujd2HDJEyMQ+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-22 22:49:12 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:39696: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-11-22 22:49:17 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (jetous) [72.241.202.104]:39667: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 22:49:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FsIMIjJE8oyPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-22 22:49:46 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:39964: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 22:50:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RAIOJDJElypniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-22 22:50:15 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:50578: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 22:51:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<bKJSKTJEmJYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 22:52:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<lnZCKzJE5qBn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-22 22:52:25 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43421: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-22 22:52:43 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:53148: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 22:53:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<TKqJLjJEgowEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.210.123.17
country_id: 1819730
description:
Nov 22 22:52:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.210.123.17, lip=66.85.158.91, session=<seT/KzJEgJYI0nsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 22:53:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ly4KLzJExLGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 22:56:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<860/OTJECr4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 22:55:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rDJkNzJExMDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 22:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<mvFsODJEUIc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 22:56:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Q9BHOzJEQM8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 22:56:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lE6yPDJEHF+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 22:57:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<lvQmPTJEZoUrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.254.207
country_id: 99237
description:
2025-11-22 22:58:24 dovecot_plain authenticator failed for ([31.57.166.48]) [62.201.254.207]:14450: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.181.36
country_id: 3996063
description:
2025-11-22 22:58:35 dovecot_plain authenticator failed for fixed-187-189-181-36.totalplay.net ([31.57.166.48]) [187.189.181.36]:54596: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.206.185
country_id: 99237
description:
2025-11-22 22:58:46 dovecot_plain authenticator failed for ([31.57.166.48]) [185.187.206.185]:22186: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:00:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<W+umSTJE1KkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<x6DASzJE0phn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.88
country_id: 3017382
description:
Nov 22 23:01:19 host2 pure-ftpd[3797562]: (?@91.196.152.88) [INFO] New connection from 91.196.152.88


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 22 23:01:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<wlI9TTJEthVChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:01:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ERzITTJEJMwI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 23:03:27 host2 sshd[3799017]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:04:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=</pTKVTJEKD2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 23:03:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<2YCpVDJEbo0+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:05:13 host2 sshd[3800159]: Disconnected from invalid user ubuntu 202.70.82.95 port 63722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:06:47 host2 sshd[3801059]: Disconnected from invalid user rta 202.70.82.95 port 12918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 23:08:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<R6Q/ZDJEut4I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:07:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<7fpaYTJEpLh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:08:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<K9R+ZDJEtq0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:08:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LRYHZTJEfMwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:08:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=</c2gZzJEvo2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:09:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Ut4WajJENsWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:09:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3B3QajJE9LaPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-11-22 23:12:05 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (chess) [174.58.87.108]:44386: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:11:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<G8x/bzJEBKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:12:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<u/dMdTJEsTJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:13:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zuH2dTJEjNAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<HqWwczJEApJn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:12:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<eKM0dDJEdpUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:13:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Q5fNeDJEELhA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:14:05 host2 sshd[3805326]: Disconnected from invalid user deployment 202.70.82.95 port 36400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:14:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<z37sfDJExs7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 23:15:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<P/qwfzJECMk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 23:15:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<mPIwgDJEAsiUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:16:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<rKvUgjJEHNQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:16:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<gU0bgjJE4r4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:17:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<M/2fhTJEnLErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 23:18:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XmqXiTJEQDmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:21:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<I2oYlDJEPKsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 23:22:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<9CGOmDJE3rA+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:22:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kwWJmTJEuL9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:23:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<oUdDmjJEKI8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:23:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hTxjnDJE9ieYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-22 23:24:23 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:59150: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-22 23:24:47 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:41568: 535 Incorrect authentication data (set_id=parentscoignard111)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.135.168.245
country_id: 6252001
description:
Nov 22 23:25:51 host2 pure-ftpd[3812506]: (?@43.135.168.245) [INFO] New connection from 43.135.168.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.226.252
country_id: 1668284
description:
Nov 22 23:26:01 host2 pure-ftpd[3812630]: (?@165.154.226.252) [INFO] New connection from 165.154.226.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.199
country_id: 2635167
description:
Nov 22 23:26:26 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.199, lip=66.85.158.91, session=<NXgbpjJEmvYjy9LH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:27:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<iETUqDJEwKR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 23:27:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XSEFqjJEVtQ+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:28:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</UEcrzJEqIAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:29:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<MwKRrzJESNQ+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:28:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Oi5ErDJE8qcv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 23:28:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61444: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qswEszJEKOKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 23:29:36 host2 sshd[3814530]: Disconnected from invalid user clifford 62.60.131.157 port 23504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:32:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ZAEEujJE5KUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:32:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<p0gXvDJE6Ltn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:32:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uLzDvDJErMql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:33:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0VJ8vTJE/ruWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 23:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<TGLwwTJEINEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:34:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wtGiwjJEcurIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov 22 23:34:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, TLS: Connection closed, session=<iaLPwzJEYqeUcdL+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:34:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<QFpewjJEtokv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-11-22 23:34:24 dovecot_plain authenticator failed for (watomitasm) [192.81.229.179]:38326: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 23:34:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xWs9wzJEyrw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:34:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<j+3pwzJEIqwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:35:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<x6NixjJEKzxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:36:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GgNPyDJEiK4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:36:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<S1t+yjJEeolA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:37:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<ANMpzjJE7N0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 23:38:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<blp/zzJELJ8FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:37:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JOhAzDJE7Okv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-22 23:37:22 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (squittis) [73.197.194.98]:45964: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 23:38:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<Jx6h0TJEbuaUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 23:40:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<yKTN1jJEKnGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:42:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Pdv33TJERiwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 23:42:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=</1z94DJEvoU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:43:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QGeE4jJEJumYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:44:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<3zVM5jJEAJNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P5Pc5jJENr8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:47:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QKId8DJEeN52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:48:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yGHn9DJESqIv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-22 23:49:20 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (bicticacia) [73.224.171.101]:46640: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:49:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<tzKL+TJE1uUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:50:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EfC/+zJEot6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:51:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3eiNADNEOIIEkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-22 23:52:29 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:40456: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-22 23:52:49 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:34057: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:53:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Lo0XBTNETLRn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-22 23:52:12 dovecot_plain authenticator failed for (zationak) [92.62.243.174]:59189: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:54:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<FmjYCDNEvtHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:53:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8MgRBzNEjLs+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.57.26
country_id: 6252001
description:
Nov 22 23:54:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.57.26, lip=66.85.158.92, session=<GYtOCTNEauoU3Tka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 23:54:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<wPNnCjNE5sc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:55:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<u2DFDjNEho0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xoTzDjNEtJwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:56:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<KuLuETNE4ro+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 23:57:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<QPqgEzNE7sY+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<9i1jEDNEXrGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:58:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jr06FzNEJpwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:57:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8W0/FDNEft2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 23:57:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LgBbFDNEPoA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:57:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<CnbUFTNEco8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:58:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<LJQ/GTNEbKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:58:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<e7OIFzNE1URniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:59:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1iwdHDNEyqRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:01:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NdowJDNEMGunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 23 00:01:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<pezKIjNEfM2UcQQF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.9
country_id: 6252001
description:
Nov 23 00:01:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.9, lip=66.85.158.91, session=<jCjFIzNEyMwUQcIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:02:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<spVfKDNEvK8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 00:02:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<Uq+tKDNEfMEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:03:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<rxRHKTNE+tOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 00:05:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<YqTgMTNEXu0+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:06:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Q2rcNDNEBMVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 00:06:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<0wccNjNEkOY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1442NDNE+oEI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-11-23 00:07:23 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:37868: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.23
country_id: 3017382
description:
2025-11-23 00:07:52 dovecot_login authenticator failed for ([188.231.3.23]) [188.231.3.23]:34397: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:07:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<EZqbNzNEkuh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:08:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xiYhPjNEZpYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 00:09:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Ck+rPjNEuL8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:10:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NY5XRDNERJsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:10:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<7579RDNEaJ6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:11:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<I9FiRzNEKNsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:14:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<8ayeUDNEZr3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:14:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<3NjGUjNEwN1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:15:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ozMQVjNEpoQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 00:17:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<TGgdXDNENrMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:18:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<obA7YDNEksgrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 00:18:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<3FoVYTNEGp4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 00:19:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Giy7ZDNEiMGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 00:21:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xgdvaTNEjkxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 00:21:15 host2 sshd[3847192]: Disconnected from invalid user admin 2.57.121.112 port 48283 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 00:22:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bEL3bDNEDJ2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 00:22:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<KV3sbjNE5ONA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 00:23:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gMpWcDNEoKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:23:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<+cpacDNE8r6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:23:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<+1HycjNEYkwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:23:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<C6XUcjNEClinYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:24:55 host2 sshd[3849437]: Disconnected from invalid user noc 156.245.239.180 port 37008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 00:25:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<0eE3eDNEvKE+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:25:38 host2 sshd[3850284]: Disconnected from invalid user tony 130.107.240.11 port 39194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 00:26:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<+vyNfTNEvp4+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:27:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<gJBbfzNEtq52wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:27:20 host2 sshd[3851136]: Disconnected from invalid user cod 156.245.239.180 port 43996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:27:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<7GvcgTNEeLMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:28:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kB4sgjNEPr5n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:28:06 host2 sshd[3851557]: Disconnected from invalid user p 130.107.240.11 port 32866 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 00:30:03 host2 sshd[3852850]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:29:25 host2 sshd[3852310]: Disconnected from invalid user cpd 130.107.240.11 port 55186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:29:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FVlHiDNExogv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:29:48 host2 sshd[3852564]: Disconnected from invalid user p 156.245.239.180 port 49712 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:30:49 host2 sshd[3853445]: Disconnected from invalid user frappe 130.107.240.11 port 44592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:31:02 host2 sshd[3853577]: Disconnected from invalid user ftpuser 156.245.239.180 port 37082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 00:31:07 host2 sshd[3853597]: Disconnected from invalid user zx 45.151.183.142 port 45964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:31:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<6/HojTNEpIwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:31:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<oiFrjjNENN+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:31:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<2icrjzNE1OAv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:32:21 host2 sshd[3854228]: Disconnected from invalid user p 185.216.119.134 port 60812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:32:27 host2 sshd[3854256]: Disconnected from invalid user temp 190.117.52.211 port 50272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:33:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<vW5QlzNEnOLIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:33:58 host2 sshd[3855102]: Disconnected from invalid user vpn 190.117.52.211 port 51378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 00:35:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<xZ61nDNEYKwI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:35:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<o/n0nDNEltov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:36:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Bgx4oTNEhJJn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:36:59 host2 sshd[3857028]: Disconnected from invalid user ubuntu 190.117.52.211 port 58252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:37:03 host2 sshd[3857095]: Disconnected from invalid user ftpuser 185.216.119.134 port 35280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 00:36:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<SlBcoDNEBNs+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:38:20 host2 sshd[3857881]: Disconnected from invalid user vncuser 185.216.119.134 port 34348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:38:28 host2 sshd[3857944]: Disconnected from invalid user n 190.117.52.211 port 38774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:38:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Kb3zqDNE0oYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 00:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<QiUJqTNEkqMv+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Nov 23 00:39:35 host2 pure-ftpd[3858590]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 00:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Am+rqzNEaKwv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 00:40:16 host2 sshd[3859357]: Disconnected from invalid user hello 45.151.183.142 port 34542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:41:36 host2 sshd[3860214]: Disconnected from invalid user zx 190.117.52.211 port 37540 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.112
country_id: 6252001
description:
Nov 23 00:42:30 host2 pure-ftpd[3860751]: (?@198.235.24.112) [INFO] New connection from 198.235.24.112


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:42:33 host2 sshd[3860777]: Disconnected from invalid user test1 103.250.11.235 port 53616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 00:42:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<GcsftzNEets+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:42:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<tFKptzNEgKqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 00:43:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<BBkFujNEErql6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov 23 00:43:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XLzSujNE6MPG6xgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 00:44:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XpNwuzNEhghniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:44:04 host2 sshd[3861564]: Disconnected from invalid user tom 103.250.11.235 port 46106 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 00:43:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<A8bFuTNEJuo+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:44:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<dolWvTNExr0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:45:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WICvwDNEHO+nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:45:31 host2 sshd[3862880]: Disconnected from invalid user ftpuser2 103.250.11.235 port 47494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 00:45:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+G0CwjNEEtNA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Nov 23 00:45:20 host2 sshd[3862828]: Disconnected from invalid user production 118.194.230.231 port 47032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Nov 23 00:46:49 host2 sshd[3863857]: Disconnected from invalid user kamal 118.194.230.231 port 47152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 00:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<147bxjNEQoyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:47:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QvEvxzNEVN92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 00:47:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<LIkVyTNE0KwzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:48:39 host2 sshd[3864937]: Disconnected from invalid user datacom 64.227.170.15 port 36592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:49:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<JXW0zzNEGOUI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:49:56 host2 sshd[3865584]: Disconnected from invalid user xiaolin 64.227.170.15 port 59104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:49:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<eBeo0DNEIORn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 00:50:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<dIKG0TNEGrM+PIcq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:50:15 host2 pure-ftpd[3866004]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7qg40jNECukv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:51:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<AJuJ1DNEsMsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:52:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<c6hE2DNElN2PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:51:11 host2 sshd[3866668]: Disconnected from invalid user titu 64.227.170.15 port 51030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:52:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<n3nI2TNEJIwv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:53:37 host2 sshd[3867998]: Disconnected from invalid user adeel 64.227.170.15 port 56090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:53:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<xToA3jNEbLTIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:53:51 host2 sshd[3868125]: Disconnected from invalid user nikhil 57.128.173.133 port 45970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 00:54:51 host2 sshd[3869256]: Disconnected from invalid user syed 62.60.131.157 port 15785 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:55:51 host2 pure-ftpd[3870019]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:55:51 host2 sshd[3870012]: Disconnected from invalid user saka 57.128.173.133 port 57980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</mvs4zNE/sIv7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:55:46 host2 pure-ftpd[3869966]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:56:41 host2 pure-ftpd[3870470]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:56:44 host2 pure-ftpd[3870495]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-11-23 00:57:54 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:54346: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:58:04 host2 sshd[3871420]: Disconnected from invalid user noc 57.128.173.133 port 37466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-11-23 00:57:37 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:33610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 00:57:50 host2 sshd[3871240]: Disconnected from invalid user ftproot 85.133.237.178 port 38342 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 00:58:28 host2 sshd[3871707]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:58:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<i0O68DNEwsNn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 00:59:02 host2 sshd[3872107]: Disconnected from invalid user deepak 85.133.237.178 port 35712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:59:04 host2 sshd[3872166]: Disconnected from invalid user ec2-user 57.128.173.133 port 48140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:59:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<cOEY8jNEprMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:00:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<Rg929jNE6scv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:00:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<f2UD9zNEDLsv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 01:01:40 host2 sshd[3873818]: Disconnected from invalid user nikhil 85.133.237.178 port 47046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 01:02:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<L4Q5/DNEypg+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:03:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<airO/zNE0JaYIMkL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 01:04:22 host2 sshd[3876130]: Disconnected from invalid user foundry 85.133.237.178 port 49494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 01:05:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<RsBMBzREAqo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:05:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<WmE+CDRENkgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:07:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ChfiDTREhBRniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 01:07:10 host2 sshd[3877793]: Disconnected from invalid user ec2-user 45.151.183.142 port 45796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:07:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Wn0pDzRE/NKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:07:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GhZ8DzRE0rOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:07:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<CtzZDzREfup2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Nov 23 01:07:39 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, session=<F3UhEDREjtes6yiD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:09:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YQYZFTRETsVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 01:08:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<4jbiEjREVJcI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:10:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ryfiGzRE4uwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:11:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qvBMHjREEMRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 01:11:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<AzBRHjRE4IU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:11:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Xc/nHjRERqgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:11:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xyhIHTREftsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 01:11:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<SVwBHjRE5I4+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 01:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6TvWIDRE6MuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 01:12:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<qNwVIjRECK0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 01:12:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<aEQtIjRECpQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:12:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qdXUIjRELpePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:13:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ehE8JTREvKnIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:13:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<llmmJTREtJ8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:15:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<5ZYiLDREpqov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-23 01:16:38 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:35730: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 01:16:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<u0ceMDREUsU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 01:16:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<RpL3MDREUJQ+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 01:17:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ct0UMjRE6NY+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-23 01:17:17 dovecot_login authenticator failed for erpump.tcil.in [1.7.83.133]:41832: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 01:20:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<9sSjPDREwOErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 01:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<sOS2QDREHOBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:21:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<4PfnQjREKsov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:22:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<gKiBRDRE+OMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:23:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<aN3rSDREDoSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:26:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<h9qDVDREaI8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-23 01:27:45 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (hylograke) [73.213.236.66]:49064: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:28:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<SrsiWjREptZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:29:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<JKy+XTRERNOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-23 01:29:40 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (nomalis) [80.14.31.158]:58329: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 01:29:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<TzvGXjRE5oQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:30:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tQD+YDRE8R1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:31:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<DqGjZDREuuAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:31:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<NhTxZjREgNql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:32:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0unHaDRE7swv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:32:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<whQHaTREOIZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 01:33:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<qoQQbDRE2t6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<QTLUbTREvNsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<B0HUbTRE+Mxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4SbMbTREOqWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:33:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<tvAObjRE7onIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 01:33:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<HoOgazREQMQ+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:35:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LOJAcjREKtwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:36:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8EG0dTRE0pIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 01:37:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<I29qeTREApSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-23 01:37:42 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (derapice) [24.91.103.202]:41836: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.70
country_id: 6252001
description:
Nov 23 01:38:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.29.23.70, lip=66.85.158.91, session=<m2ZKfjREvqEUHRdG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-23 01:38:58 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:37018: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-11-23 01:40:04 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:33217: 535 Incorrect authentication data (set_id=monnierbenoitmichel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 01:41:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nUufhzRE7qErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 01:41:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<yJcKiDREQoII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:43:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<dBzSjjREwtUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 01:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<LEKCjzREitNn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:43:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<6cipkTREFnGYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:44:46 host2 sshd[3900405]: Disconnected from invalid user bbx 123.58.212.133 port 58880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<NcT/kzREPM0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 01:47:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<46dknjREpME+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:47:25 host2 sshd[3902255]: Disconnected from invalid user staging 123.58.212.133 port 59254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:48:36 host2 sshd[3902902]: Disconnected from invalid user qa 123.58.212.133 port 57166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:49:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<V23ZozREKq52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:48:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<mwV3oTREfn4vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-11-23 01:50:28 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:46046: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-23 01:50:48 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:47604: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:50:59 host2 sshd[3904389]: Disconnected from invalid user eric 123.58.212.133 port 42300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:51:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<1m3erDREPNKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:51:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lSHjrDREKr4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:53:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oS61szRE0iRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:53:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1skqszRE1L4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:54:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<Wx59tjREopjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:54:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FJPItzREVNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jrwmvDRE4sVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:55:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P4cSvDREdqAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:56:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<swiGvzRE4Jkv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:56:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<VtRpvTRERqRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<fC6QvTRE4ugv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:56:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nu4LvjRE1sql6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.52
country_id: 6252001
description:
Nov 23 01:57:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.52, lip=66.85.158.92, session=<hOiWwTREbuoUqWk0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-23 02:00:52 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:59524: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-11-23 02:01:09 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:43024: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:01:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<gdpP0DREyJiWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 02:01:39 host2 sshd[3911429]: Disconnected from invalid user kaci 62.60.131.157 port 34938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:01:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jC5l0TREZs8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:04:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7afj2TREnl2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JnId2jRE2t8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:05:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<o9IV3zREkr5n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:06:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<z5rQ4jREfrYv+3xn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:08:06 host2 sshd[3915299]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 02:07:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZLWS5jREtLs+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 02:08:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<QMok6zREmuw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:09:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<B6Od7DRENqZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:09:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fD+t7TRE4m4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:11:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<51Vx9DREAJYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:13:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FCF6/DRE3penYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 02:13:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<U6Q6/TREUNsI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:14:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xfJw/TREKLAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 02:14:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<x4nS/TRELJ0+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:14:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<3wfn/zREksXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:15:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pdxVATVEMrGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-23 02:15:31 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:57421: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-23 02:15:47 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:55336: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 02:16:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<5drDBTVErC5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:16:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<znn1BTVEKtEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:17:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<qlTrCTVE4NII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 02:17:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<zF1YCzVE0JDF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 02:17:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NC55CzVEFOJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 02:18:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<SP1yDDVEnp4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 02:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1Q/yETVEfIBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 02:20:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<dbRPEzVE9uE+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:20:23 host2 sshd[3923275]: Disconnected from invalid user user1 161.132.50.17 port 47740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 02:20:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<EeaRFTVEjril6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:22:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<MgUyGzVEao4rpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:24:20 host2 sshd[3925330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 02:23:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<pdxWIDVEjuo+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:24:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<e58ZIjVE+EmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:24:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<y9j+IzVETuov+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:25:48 host2 sshd[3926605]: Disconnected from invalid user admin 161.132.50.17 port 47892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:26:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<iKdHKDVE3paWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 02:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<MVfxKjVEeNs+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:27:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<7Hv9LDVEFI5n9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:28:21 host2 sshd[3928176]: Disconnected from invalid user ec2-user 161.132.50.17 port 57382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:28:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1ihwMTVECJIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:29:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<otwBNTVEbL12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:30:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yldYOTVEwCMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:31:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3ZbzOzVE4LwEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:32:16 host2 sshd[3930842]: Disconnected from invalid user henry 161.132.50.17 port 41142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 02:32:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<jjwoPzVE7us+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.199
country_id: 6252001
description:
Nov 23 02:33:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.199, lip=66.85.158.91, TLS, session=<XjRtQzVECvTN0h/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ECazRTVEzJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 02:34:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<M6cPRjVEjKA+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:34:52 host2 sshd[3932374]: Disconnected from invalid user git 161.132.50.17 port 54336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:35:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<EFBeSDVEmMjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:35:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BCumSDVEOqePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 02:35:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<zEdMSTVEEs4+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 23 02:35:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<GGL2STVEKJKLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:35:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<w16bSzVEngSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:36:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cBksTjVEoLgv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov 23 02:37:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.92, TLS, session=<X/+bUDVEkv3G6xhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:38:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Jp6lVTVENJUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 02:38:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VWu0VTVEVzZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 02:39:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mv4EWTVEgJw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 02:39:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<FDqkWTVEXOZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 02:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<aevNWDVE5uwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:42:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<G2IhZDVESt0+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:43:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<APsCZTVE+LsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 02:43:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<a5CfZTVERsY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 02:43:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xYz7ZTVEpshA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:44:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zF2BajVEyNY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<nlecajVE3jaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:45:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<6pE2bTVEIIAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 02:45:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0/pObTVECsWl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 02:46:09 host2 sshd[3939812]: Disconnected from invalid user admin 2.57.121.112 port 14954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 02:46:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+XM3cjVEaMYI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:48:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<s6QeejVE2LBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:49:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<59rPfTVEOrV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:50:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<LsMsgDVEQOcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:50:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dqJcgDVE0oOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:52:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BrY+hTVErrUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:51:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wTchgzVEmMcEkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:52:33 host2 sshd[3943342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<SqUSkDVEXOKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:54:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dlRujjVEeIQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<GhuajzVEooTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:56:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TqAEljVEYqAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 02:57:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<2sU+mjVERtg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:58:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<of49mzVEWmSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:59:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<tuz+njVEUNk+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:59:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<QbCvoTVESsYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 03:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<mi4WpjVExqY+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:01:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eWkApjVESjVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:00:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<+GYbpTVESqYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:01:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<euqzpjVEfI5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-23 03:03:03 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:54040: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:03:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vMjsrTVEoOgrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-23 03:03:34 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:39438: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:04:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<zYKnsjVEKvqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:05:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<4GKktjVEiIUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:07:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<dG44uzVEnNZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 03:07:23 host2 sshd[3952779]: Disconnected from invalid user admin 2.57.121.112 port 54659 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:10:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wPypxjVECrd2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:09:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<UD8VxDVEtKyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-11-23 03:10:08 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:49736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 03:10:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<RThHxzVEeu1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:11:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<yuG+yTVEdqcEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 23 03:11:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=</Qy5yjVElcAtQ5ts>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.246
country_id: 953987
description:
Nov 23 03:12:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.41.246, lip=66.85.158.91, TLS, session=<LqHeyzVEH7BmQCn2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:12:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<KmT2zjVEEokv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:13:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<91Be0DVErsovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:14:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2bJP1zVEBt0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:15:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BHqf1zVEXMqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 03:15:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7ivg1zVEtrSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<h0kn1zVEMLPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:16:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cX/L3TVE/ocv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-11-23 03:17:16 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:52388: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-23 03:17:52 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:57565: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 03:18:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<xBpD4jVELuOSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 03:18:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<huc45TVEjMY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 03:19:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<dsHd5zVERrEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 03:19:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<hbRD6TVEQrc+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 03:20:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<i/Jk6zVEmAunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:21:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<yAmu7TVEJNUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 03:21:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Uh827zVEMOMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:22:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<J6du8zVEjtxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:23:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nYuY9jVEFUdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:23:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<YGdx9zVEjKcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:24:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<WkwI+zVE8OaYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.142
country_id: 6252001
description:
Nov 23 03:26:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.142, lip=66.85.158.92, TLS: Connection closed, session=<xZCp/zVERLXHLZqO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 03:27:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<6rrvAjZE4sE+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:26:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</oPvADZETIsv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 03:30:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51688: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:30:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A2r1DzZEuNJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:31:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eqLsEDZEPqhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:31:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lUT+EDZE2uYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 03:32:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Fkn4FTZE7qQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:32:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Zd4kFjZEKtcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 03:32:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<UreLFzZEpqE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 03:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<KaX3GjZEQIc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:33:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nnJNGzZEHNKl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-23 03:34:15 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:52404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:34:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<gmXBHjZEKrvIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:35:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<mfXmHzZEBp+PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-23 03:34:24 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:32992: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:34:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<7blwHjZEwKIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+RVvIDZE7MYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 03:36:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<PHczIzZEipg+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:36:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<YOGoJTZE5t0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 03:37:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<xspuJzZELuc+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:38:24 host2 sshd[3979212]: Disconnected from invalid user sl 64.227.76.143 port 34964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:38:53 host2 sshd[3979441]: Disconnected from invalid user irma 189.8.108.156 port 46026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 03:39:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7vcuMDZEUMmWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.74.210
country_id: 6252001
description:
Nov 23 03:40:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.74.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<gkeeMTZEANcUDkrS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:41:09 host2 sshd[3981051]: Disconnected from invalid user astra 64.227.76.143 port 56176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:40:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<jnR6MzZENOIv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:42:14 host2 sshd[3981629]: Disconnected from invalid user naim 64.227.76.143 port 37938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.173
country_id: 3865483
description:
Nov 23 03:42:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@weeratrading.com>, method=PLAIN, rip=45.238.106.173, lip=66.85.158.91, TLS, session=<RvpfOTZE1oEt7mqt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.94
country_id: 3175395
description:
Nov 23 03:43:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.94, lip=66.85.158.91, TLS, session=<Ad7COjZEG43ZGrNe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:43:15 host2 sshd[3982180]: Disconnected from invalid user znc 64.227.76.143 port 34652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 03:43:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<f/22PDZEIv2nYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.62
country_id: 6252001
description:
Nov 23 03:42:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4h48OjZE9N0UQcM+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:43:25 host2 sshd[3982293]: Disconnected from invalid user support 34.66.72.251 port 59292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 03:43:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<GTBMPTZEfOgI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov 23 03:43:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.49, lip=66.85.158.91, TLS: Connection closed, session=<NFGEPjZEutKnXpIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:45:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<5gMyQzZEhtOYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-11-23 03:45:20 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:38745: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:44:25 host2 sshd[3982766]: Disconnected from invalid user steam1 34.66.72.251 port 43600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:44:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<P0MYQTZEvuRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:44:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+TeeQTZEkNUrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:44:47 host2 sshd[3982904]: Disconnected from invalid user rk 189.8.108.156 port 38120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:45:09 host2 sshd[3983384]: Disconnected from invalid user andrew 64.227.76.143 port 44048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:45:26 host2 sshd[3984133]: Disconnected from invalid user p 34.66.72.251 port 37054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-23 03:45:40 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:50174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:46:18 host2 sshd[3984949]: Disconnected from invalid user steam1 189.8.108.156 port 39424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 03:46:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=</2oWSDZEvoU+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.69
country_id: 798544
description:
Nov 23 03:46:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=77.65.142.69, lip=66.85.158.91, TLS, session=<HcKNRzZES5tNQY5F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Nov 23 03:46:40 host2 sshd[3985365]: Disconnected from invalid user ec2-user 34.93.128.179 port 46694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov 23 03:46:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<jJydSDZEHrvJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:46:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LPGFRzZEgARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:47:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<XtfVSzZEVpEv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:47:48 host2 sshd[3986493]: Disconnected from invalid user support 189.8.108.156 port 34352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 03:49:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<q+YQUzZE+oA+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-23 03:50:04 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:43997: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.107
country_id: 6252001
description:
2025-11-23 03:50:15 dovecot_login authenticator failed for ([70.174.168.107]) [70.174.168.107]:37475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 03:50:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<cABzVjZEGpw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:51:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<gJXtWDZEMrwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:51:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<3A3uWDZESsF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 03:51:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<oVy7WjZEJJwI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:52:10 host2 sshd[3990173]: Disconnected from invalid user astra 189.8.108.156 port 52978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:52:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<oIuPXDZEvOAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<4R+sZzZEBLLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<P5KkZzZEwuxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:55:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<AL6maDZEOqGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:55:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<j3jNaTZEsrAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:56:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<u91RbTZEBsYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:57:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<YBLlbjZEMqQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:58:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<h+K3dDZEJK6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 04:00:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<1/Y9ejZEnOIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 04:00:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<BLk5ejZEkKo+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Nov 23 04:03:49 host2 sshd[4003242]: Disconnected from invalid user main 69.74.29.21 port 15797 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 04:05:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<hBj9ijZEvOEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 04:05:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8qYcizZEvNWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 04:05:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<WjdxizZEur2YIMkL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Nov 23 04:05:00 host2 sshd[4004701]: Disconnected from invalid user jira 69.74.29.21 port 42027 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 04:05:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<kjFOjDZEWJIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 04:06:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<F1l4jjZElNCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 04:06:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<8Ql4jzZEhqA+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 04:06:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CFmRkDZE/r1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Nov 23 04:07:28 host2 sshd[4007676]: Disconnected from invalid user debian 69.74.29.21 port 19145 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 04:08:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<jWMQljZE0pUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 04:08:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<u9ZEmDZEbA5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 04:09:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<gAr2mTZE5pI+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 04:09:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<RjlOmjZEvME+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 23 04:10:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<x/7MnDZEXMEFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 04:11:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<AogmoTZESIEEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 04:11:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<9dPpoTZEdtZ2wSaf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.248
country_id: 2635167
description:
Nov 23 04:11:37 host2 pure-ftpd[4012622]: (?@87.236.176.248) [INFO] New connection from 87.236.176.248


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 04:12:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6EzzozZECjkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 04:14:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<2oLXrDZEkMU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 04:16:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3LfSsjZEgJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 04:15:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<LqJ5sDZECMnIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 04:15:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<WTzDsDZEgLWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 04:16:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xawNtTZE9K0v7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 04:18:17 host2 sshd[4017322]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.119.88.100
country_id: 6252001
description:
Nov 23 04:17:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.119.88.100, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rhu2tzZE8qGHd1hk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.210.82.243
country_id: 6252001
description:
Nov 23 04:17:42 host2 sshd[4016878]: Disconnected from invalid user test 172.210.82.243 port 44546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 04:19:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</wp8vjZEZsBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 04:19:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=</33TvzZEUOEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 04:20:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<VVNHwTZEbK0v7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.112.26
country_id: 6252001
description:
Nov 23 04:20:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.233.112.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0Q9uwjZEGoOH6XAa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.58
country_id: 690791
description:
Nov 23 04:23:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=195.64.244.58, lip=66.85.158.91, TLS, session=<VOk7zDZE76XDQPQ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.220
country_id: 2300660
description:
Nov 23 04:24:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.28.220, lip=66.85.158.91, TLS, session=<SzNjzTZE96Ypixzc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 04:24:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GW81zzZEstyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 04:25:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<t1n+0TZEJIcI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 04:25:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<R7iP0jZEgKmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 04:24:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ofEo0DZEPKw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 04:24:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<beFS0TZE+pM+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 04:26:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<fFFl1jZEIsArpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 04:26:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<psd22DZEstsI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-11-23 04:26:22 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:44484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.210.82.243
country_id: 6252001
description:
Nov 23 04:26:39 host2 sshd[4023727]: Disconnected from invalid user p 172.210.82.243 port 42740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-11-23 04:26:42 dovecot_login authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:52454: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 04:29:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<kswp4DZE2Jcv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 04:29:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<aOJc4DZE2gWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 04:29:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<M2qb4TZESJhn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.26.88.83
country_id: 732800
description:
Nov 23 04:29:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.26.88.83, lip=66.85.158.92, session=<S1/54jZErtteGlhT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 04:31:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lvo15zZEQoIEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 04:31:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<gaaO5zZEDM+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 04:31:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<u7GP6DZEahVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 04:32:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Ar8C6zZEHrB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 04:32:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<z4HY6zZEXvovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Nov 23 04:32:38 host2 sshd[4027656]: Disconnected from invalid user ec2-user 36.37.122.175 port 54214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov 23 04:33:11 host2 sshd[4027972]: Disconnected from invalid user vmail 102.176.81.29 port 45742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.73
country_id: 1880251
description:
Nov 23 04:34:37 host2 sshd[4028770]: Disconnected from invalid user keycloak 101.47.140.73 port 54116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Nov 23 04:35:05 host2 sshd[4029296]: Disconnected from invalid user github 36.37.122.175 port 45376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 04:35:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rCOg+DZEms6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 04:36:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<qpH1+TZESo3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 04:36:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yOG7+zZESIQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 04:37:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xAMN/TZEHpYv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Nov 23 04:36:25 host2 sshd[4030075]: Disconnected from invalid user ankit 102.176.81.29 port 56920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-11-23 04:36:42 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:48002: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-23 04:37:04 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:41292: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.73
country_id: 1880251
description:
Nov 23 04:37:10 host2 sshd[4030437]: Disconnected from invalid user test 101.47.140.73 port 37302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov 23 04:37:48 host2 sshd[4030692]: Disconnected from invalid user ftpuser 102.176.81.29 port 59744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Nov 23 04:37:45 host2 sshd[4030676]: Disconnected from invalid user john 36.37.122.175 port 56200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Nov 23 04:39:16 host2 sshd[4031754]: Disconnected from invalid user vpn 36.37.122.175 port 59264 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 04:39:43 host2 sshd[4032341]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 04:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kDFYCDdELJ8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 04:42:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<vjzvEDdExpEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 04:43:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<vfyRFTdEzuFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 04:44:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<uqhsGDdEQMg+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 04:44:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<EjAVGTdEiLvF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 04:45:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ahjHGTdE4JSYIMkL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 04:46:29 host2 sshd[4036642]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 04:46:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<b9j+HjdEeM0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 04:47:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nQdsIDdE0O0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 04:48:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<2nVeJTdEcMYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 04:49:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<9/SFKTdEFpUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 04:50:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<U6+UKzdEpLyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 04:50:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<8ZwaLTdE2J0EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 04:50:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5bFbLTdE/tRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 04:52:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<gImzMjdElsIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 04:52:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<cawMMzdEooWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 04:52:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<LtBjNDdE4u12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 04:53:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GmcnODdEqB5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 04:54:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<SOV7OTdEGKE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 04:55:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<tSBnPzdEDus+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 04:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<l0SWQDdEgJCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 04:57:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<6D5uRDdESNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 04:57:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<DTRgRTdE0sWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 04:56:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<8/q2QjdELMPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 04:57:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<24luRDdEcuwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 04:58:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<kFmbSTdEXuAI3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-23 04:59:06 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:49415: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 04:59:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<HtizTjdEYqgv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.79.168
country_id: 357994
description:
2025-11-23 04:59:31 dovecot_login authenticator failed for ([41.178.230.115]) [154.239.79.168]:60038: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 23 05:00:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<9gQoUjdE6OXPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 23 05:00:52 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<VzYjUjdECprPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.15
country_id: 6252001
description:
Nov 23 05:00:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qci0UDdEFcuTuYQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 05:05:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<jaUfYTdEfoCYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 23 05:06:13 host2 pure-ftpd[4050650]: (?@66.132.153.124) [INFO] New connection from 66.132.153.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.8
country_id: 1733045
description:
2025-11-23 05:06:20 dovecot_login authenticator failed for ([49.124.151.8]) [49.124.151.8]:40452: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 05:05:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<OroUYzdEnNIv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-23 05:05:56 dovecot_login authenticator failed for (a1aB1zmh) [185.196.8.151]:51523: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 05:06:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<XgecZjdE5sY+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-23 05:06:42 dovecot_login authenticator failed for (6Ajx3rUs5) [185.196.8.151]:62238: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.205
country_id: 6252001
description:
Nov 23 05:08:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fhv5azdE2szG6xjN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 05:07:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hjI1ajdE5qwrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-23 05:07:50 dovecot_login authenticator failed for (jyKv50EE3f) [185.196.8.151]:60766: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 05:08:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<46u5bTdE+sRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 05:10:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<w9wYczdEXJIv+yXY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 94.102.49.155
country_id: 2750405
description:
Nov 23 05:10:19 host2 pure-ftpd[4053491]: (?@94.102.49.155) [INFO] New connection from 94.102.49.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 05:09:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<qSB4cjdEGrAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 05:10:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<SDsCczdE5LgEkXBg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 23 05:10:06 host2 sshd[4053210]: Disconnected from invalid user yuval 165.227.32.198 port 33788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 05:11:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7TtSdzdEztNn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Nov 23 05:10:24 host2 sshd[4053515]: Disconnected from invalid user ismail 8.213.197.49 port 50058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 05:12:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<T7MPejdEhvgvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.255.69
country_id: 2921044
description:
Nov 23 05:14:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.255.69, lip=66.85.158.91, TLS, session=<JNqugjdE9qHPmv9F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 05:14:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=</TtzgzdEyuw+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 23 05:14:52 host2 sshd[4056847]: Disconnected from invalid user php 165.227.32.198 port 47436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 05:15:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Xi8PhjdEgESnYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Nov 23 05:15:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, TLS, session=<ZexyhjdE0uKTuYRY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 05:15:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<M5CDhjdEtMul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 05:16:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+kZEiDdEfgVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 05:16:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<+d13izdE4pnIMGRT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.124.149
country_id: 3042225
description:
Nov 23 05:17:03 host2 pure-ftpd[4058687]: (?@91.90.124.149) [INFO] New connection from 91.90.124.149


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 05:16:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<j2cNiTdEqLmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 05:17:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<i08RjDdE5tQv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.88.9
country_id: 660013
description:
Nov 23 05:17:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.126.88.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VpBLjDdEJoS8flgJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 05:17:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cBK0jTdECscv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 05:19:25 host2 sshd[4060024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 05:19:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<1L+3lTdElN0v7bxd>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 140.177.125.207
country_id: 6252001
description:
Nov 23 05:21:52 host2 sshd[4061436]: Disconnecting authenticating user root 140.177.125.207 port 54392: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 140.177.125.207
country_id: 6252001
description:
Nov 23 05:21:52 host2 sshd[4061436]: error: maximum authentication attempts exceeded for root from 140.177.125.207 port 54392 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.213.197.49
country_id: 1605651
description:
Nov 23 05:21:53 host2 sshd[4061440]: Disconnected from invalid user cacti 8.213.197.49 port 58706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 05:23:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wWhioTdE6uiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 23 05:24:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<fBTzpjdE7OYFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 05:25:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Lz87qTdE1myYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 05:26:19 host2 sshd[4064115]: Disconnected from invalid user admin 2.57.121.112 port 46896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.133.75.201
country_id: 2750405
description:
Nov 23 05:27:39 host2 sshd[4064711]: Disconnected from invalid user ec2-user 195.133.75.201 port 49590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Nov 23 05:29:01 host2 sshd[4065487]: Disconnected from invalid user user 104.28.192.66 port 24856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 05:28:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<uF0dtDdEftorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 05:28:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<gV6ptTdE7J8v+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.224.207
country_id: 6252001
description:
Nov 23 05:28:59 host2 pure-ftpd[4065482]: (?@20.15.224.207) [INFO] New connection from 20.15.224.207


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 05:29:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Vwg1uTdEtNo+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 05:29:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<vd2SuTdEoLsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 05:30:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<msdGvTdE2I8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 05:31:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<kKCwwDdE4pkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 05:32:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<w7JvwTdENpEvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.224.66
country_id: 2635167
description:
Nov 23 05:31:38 host2 sshd[4067185]: Disconnected from invalid user ec2-user 104.28.224.66 port 13561 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 05:32:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<DdvPwjdEhNw+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 05:32:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NKDpwjdENONn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.133.75.201
country_id: 2750405
description:
Nov 23 05:32:27 host2 sshd[4067639]: Disconnected from invalid user ubuntu 195.133.75.201 port 46760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Nov 23 05:32:48 host2 sshd[4067834]: Disconnected from invalid user usman 104.28.192.67 port 15253 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.133.75.201
country_id: 2750405
description:
Nov 23 05:33:31 host2 sshd[4068154]: Disconnected from invalid user michael 195.133.75.201 port 42564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 05:33:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<riUExzdEXuF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 05:33:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7hSwxjdEVrJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 05:34:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<49+MyTdESM8+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.133.75.201
country_id: 2750405
description:
Nov 23 05:34:34 host2 sshd[4068728]: Disconnected from invalid user ftpuser 195.133.75.201 port 40946 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 05:35:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ywxizjdE8og+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 05:36:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<7j1x0jdEItKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Nov 23 05:36:48 host2 sshd[4070549]: Disconnected from invalid user ca 104.28.192.67 port 52940 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 05:37:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xTD00zdEzr0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.249
country_id: 6252001
description:
Nov 23 05:37:33 host2 sshd[4071143]: Disconnected from invalid user usman 172.245.92.249 port 58414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.130
country_id: 798544
description:
Nov 23 05:37:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=178.219.97.130, lip=66.85.158.91, TLS, session=<AlSR1DdEPeay22GC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 05:37:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wfod1jdE0oXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.112
country_id: 3175395
description:
Nov 23 05:37:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.170.112, lip=66.85.158.91, TLS, session=<GYGh1TdEq8W5D6pw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 05:38:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YRbW2DdEYwtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 05:38:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iXq02TdEsPunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 05:38:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<z1Hm1zdE2rAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 05:38:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<RsA52DdE3Jw+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.97.117.34
country_id: 1269750
description:
Nov 23 05:39:51 host2 sshd[4072458]: Disconnected from invalid user dspace 14.97.117.34 port 58613 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 05:39:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<BR9q3TdE5Okv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 05:41:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<vXBs4jdEwo6l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.249
country_id: 6252001
description:
Nov 23 05:41:48 host2 sshd[4073568]: Disconnected from invalid user p 172.245.92.249 port 41486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-11-23 05:41:54 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:45122: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-23 05:42:09 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:46348: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Nov 23 05:42:23 host2 sshd[4073921]: Disconnected from invalid user p 14.97.117.34 port 20303 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.249
country_id: 6252001
description:
Nov 23 05:42:51 host2 sshd[4074047]: Disconnected from invalid user arpan 172.245.92.249 port 38174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.110.43
country_id: 2921044
description:
Nov 23 05:43:55 host2 sshd[4074438]: Disconnected from invalid user david 142.93.110.43 port 51066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 05:45:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<gSY+8DdEuOM+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov 23 05:44:37 host2 sshd[4075291]: Disconnected from invalid user manager 152.32.130.118 port 55124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 05:45:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<enhU8jdEBlqYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Nov 23 05:45:58 host2 sshd[4076289]: Disconnected from invalid user user 104.28.192.66 port 17404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.110.43
country_id: 2921044
description:
Nov 23 05:47:15 host2 sshd[4076965]: Disconnected from invalid user ftptest 142.93.110.43 port 52226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 05:48:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<18/A+zdE8sY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 05:49:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<eL5u/jdE0rCWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 05:49:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Cbyh/jdEXporpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.90.107
country_id: 2017370
description:
Nov 23 05:49:17 host2 sshd[4078061]: Disconnected from invalid user deploy 64.188.90.107 port 55876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov 23 05:49:52 host2 sshd[4078294]: Disconnected from invalid user ftpuser 152.32.130.118 port 53644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 05:49:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lJ93AThE7psEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 05:51:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<i/JOCDhEPNov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 05:51:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<MIp9CDhEPoov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 05:52:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<GLE8CThEGtkvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.224.67
country_id: 2635167
description:
Nov 23 05:51:20 host2 sshd[4079374]: Disconnected from invalid user raaj 104.28.224.67 port 15319 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Nov 23 05:52:20 host2 sshd[4079919]: Disconnected from invalid user server 152.32.130.118 port 52102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-23 05:52:21 dovecot_plain authenticator failed for (amenize) [65.20.186.177]:33464: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.110.43
country_id: 2921044
description:
Nov 23 05:52:24 host2 sshd[4079943]: Disconnected from invalid user test02 142.93.110.43 port 35444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.90.107
country_id: 2017370
description:
Nov 23 05:53:25 host2 sshd[4080432]: Disconnected from invalid user composer 64.188.90.107 port 35060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 05:53:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ynFNDzhEwoMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 05:53:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<XThmDzhEGNpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 05:54:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<JkpwEDhEdsR2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Nov 23 05:54:59 host2 sshd[4082025]: Disconnected from invalid user fernando 152.32.130.118 port 33852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.90.107
country_id: 2017370
description:
Nov 23 05:54:36 host2 sshd[4081871]: Disconnected from invalid user ec2-user 64.188.90.107 port 44700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 23 05:55:23 host2 sshd[4082407]: Disconnected from invalid user ftpuser 103.145.145.75 port 55162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.66
country_id: 2635167
description:
Nov 23 05:55:24 host2 sshd[4082417]: Disconnected from invalid user michael 104.28.192.66 port 30253 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.188.90.107
country_id: 2017370
description:
Nov 23 05:55:42 host2 sshd[4082611]: Disconnected from invalid user kafka 64.188.90.107 port 45176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Nov 23 05:56:09 host2 sshd[4082828]: Disconnected from invalid user frappe 203.145.143.163 port 55878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 05:57:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<2PENHDhE4pSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 05:57:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<UKn2GzhE4KYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 05:58:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<4PGSHjhE2sDF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 05:58:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Yp5mHzhE5KxA44h6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 05:59:48 host2 sshd[4084846]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 05:59:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<F5ZiJDhE7LDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 05:59:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<WiZJJThEpK8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 05:59:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<qqyGIjhElJov+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.143.163
country_id: 1269750
description:
Nov 23 06:00:50 host2 sshd[4085727]: Disconnected from invalid user data 203.145.143.163 port 51784 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:01:11 host2 sshd[4085928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 06:01:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UbO8KThEcxZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 06:01:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<5UGeLDhETuanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 06:02:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<kjHzLThEroE+PIcp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:03:51 host2 sshd[4087820]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 23 06:03:28 host2 sshd[4087490]: Disconnected from invalid user ftpuser 103.145.145.75 port 52756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Nov 23 06:03:37 host2 sshd[4087621]: Disconnected from invalid user ubuntu 203.145.143.163 port 56182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 06:03:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<WoiYMzhE1OU+PIcp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:05:13 host2 sshd[4088950]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 06:05:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<x4C2OThERq0+PIOI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 23 06:05:55 host2 sshd[4089408]: Disconnected from invalid user odoo 103.145.145.75 port 50562 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:06:33 host2 sshd[4089709]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 06:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<nva0OzhEWkeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 06:07:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5AD/PjhE/rCl6LP6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:07:59 host2 sshd[4090468]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 06:08:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<NhEzQjhEssw+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 23 06:08:25 host2 sshd[4090714]: Disconnected from invalid user fivem 103.145.145.75 port 48368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.192.67
country_id: 2635167
description:
Nov 23 06:08:59 host2 sshd[4090961]: Disconnected from invalid user test 104.28.192.67 port 9416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 23 06:09:41 host2 sshd[4091508]: Disconnected from invalid user gianluca 103.145.145.75 port 47270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 06:10:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<1oNCSThEWMI+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 06:10:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<aSBfSThE1sgrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:10:40 host2 sshd[4092182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 06:10:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<g1VYSjhEao4EkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:12:02 host2 sshd[4092898]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:12:19 host2 sshd[4093090]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 06:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1rW6UThEHDYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 06:12:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Beu1UzhEnOsv+yXY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:13:25 host2 sshd[4093678]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 23 06:13:45 host2 sshd[4093841]: Disconnected from invalid user ec2-user 196.189.237.92 port 57122 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:14:49 host2 sshd[4094523]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 06:14:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<PObsWThEGup2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 06:15:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<VEGFWzhEkpQv+3xn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:16:09 host2 sshd[4095349]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 06:15:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pIwYXDhEHONn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 06:15:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@monarchdss.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<iffEXDhEuME+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.13
country_id: 6252001
description:
Nov 23 06:15:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u0xjXThEH82TuYQN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 06:15:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Kh9HXjhEzNsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 06:15:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6wsVXDhE2t6WXx+e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:17:27 host2 sshd[4095985]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 06:18:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<h9u9ZThEkqY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 06:17:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<guumYzhELo8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 06:17:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Ce/UZThESp6PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.184.83
country_id: 6252001
description:
Nov 23 06:18:10 host2 sshd[4096225]: Disconnected from invalid user p 67.10.184.83 port 45362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 06:18:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<cNMMaThEnpWSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Nov 23 06:19:51 host2 sshd[4096988]: Disconnected from invalid user leonardo 196.189.237.92 port 56670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 06:20:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<BcPkbDhEBIY+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 06:20:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Q6BJbThE/OQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 06:20:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<fK2FbThEDoUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 06:21:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<dKOvcDhEJMo+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 06:21:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<8P0ccjhErrnIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.197.60
country_id: 3865483
description:
Nov 23 06:22:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.96.197.60, lip=66.85.158.91, TLS, session=<jeKUczhEv8+6YMU8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Nov 23 06:22:16 host2 sshd[4098420]: Disconnected from invalid user p 196.189.237.92 port 45916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.38
country_id: 3175395
description:
Nov 23 06:22:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.68.179.38, lip=66.85.158.91, TLS, session=<8R/ndDhENOe5RLMm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 06:24:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<fTBvezhEAh9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 06:23:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<BSiueDhEqKBA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.184.83
country_id: 6252001
description:
Nov 23 06:23:27 host2 sshd[4098963]: Disconnected from invalid user server 67.10.184.83 port 42476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 23 06:23:35 host2 sshd[4099068]: Disconnected from invalid user salman 103.189.235.65 port 54468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 06:25:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<C4DHfzhEhlmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 06:25:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<d/JkgjhESoo+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-23 06:26:44 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (nonta) [196.47.172.253]:60247: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 06:26:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<+A8lhThEJDWYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 23 06:27:55 host2 sshd[4101343]: Disconnected from invalid user ubuntu 103.189.235.65 port 52874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 06:30:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<0ZrskjhEBoMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 06:30:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=</+mUkzhESogrpAFm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 23 06:31:52 host2 sshd[4103644]: Disconnected from invalid user p 103.189.235.65 port 38380 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 06:32:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<k8FomjhEhAovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 06:34:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<h027nzhEsNgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 06:35:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<rD6WozhE1Kp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.93
country_id: 6252001
description:
Nov 23 06:35:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qfpmpThEx9iTuYRd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.88
country_id: 732800
description:
Nov 23 06:37:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.253.159.88, lip=66.85.158.91, TLS, session=<Emo9qjhENJe5/Z9Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 06:37:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PSgiqzhEoOUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 06:37:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<GVKTqzhELKhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 06:37:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<JDPDqzhERIo+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.135.197.253
country_id: 2510769
description:
Nov 23 06:37:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.135.197.253, lip=66.85.158.91, TLS, session=<7bfnqzhEu60th8X9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 06:38:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<In4UrzhEDsov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 06:38:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<sl8fsDhEqo4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 06:39:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PogasThENsKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 06:38:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<M1wUrjhEuMUI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 06:40:35 host2 sshd[4109573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 06:40:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<s1QutThEVtQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 06:41:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<oX04uThEiN0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 06:41:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Sp4tuzhEQqWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 06:42:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<0VHZuzhEeJs+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-11-23 06:44:06 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (humpus) [73.137.7.97]:46844: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 06:43:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<OQSOwDhEmuLIMGRT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.121.191.159
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.121.191.159 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 06:45:38 host2 sshd[4112845]: Disconnected from invalid user admin 2.57.121.112 port 30868 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.120.41
country_id: 6252001
description:
Nov 23 06:45:45 host2 pure-ftpd[4113068]: (?@40.124.120.41) [INFO] New connection from 40.124.120.41


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 06:46:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<1kYxzThEZydniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 06:46:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ET9SzThETJhA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 06:46:25 host2 sshd[4113847]: Disconnected from invalid user adonis 62.60.131.157 port 49113 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 06:47:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<M5tyzjhEWvmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 06:48:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NvbT0zhE+iunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 06:50:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<XwmA2zhEksMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 06:51:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=</waF3jhEtrYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 06:52:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<l1223zhESu0+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 06:53:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<US2D4zhESnYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 06:56:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<qtw97jhEOqp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 06:55:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<KBys6zhEzsUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 06:57:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<M/OM8zhEJM4v7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-23 06:58:01 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:59322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2025-11-23 06:58:40 dovecot_login authenticator failed for (2-55-84-240.orange.net.il) [2.55.84.240]:42408: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 06:59:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Djac+DhEdLNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 06:58:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<q5fl9ThE7uI+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 06:59:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+IK5+zhEPtCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 06:59:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<pKve+zhEyJg+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 06:59:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<8w4D/DhE/LKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.15
country_id: 3469034
description:
Nov 23 07:00:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=177.44.71.15, lip=66.85.158.91, TLS, session=<k4t5/DhEG7exLEcP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 07:00:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<tfTS/ThEiq8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.3.74
country_id: 690791
description:
Nov 23 07:00:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.3.74, lip=66.85.158.91, TLS, session=<kly//ThEN7ywZwNK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 07:00:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<EtR1/ThENuIv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-23 07:01:49 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:50539: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-11-23 07:02:12 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:51711: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 07:02:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<U6ofBDlE/sIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 07:02:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xCBTBDlEWMcv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 07:03:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<ubn0BjlEYJs+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 07:03:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<QHuDCTlElus+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 07:05:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<+9VXDjlE+NrIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 07:07:03 host2 sshd[4126649]: Disconnected from invalid user adonis 62.60.131.157 port 64434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 07:07:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<k5FeGDlEiKU+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 07:08:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Spm+GDlEtOeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 07:08:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<nzu5GjlEhM1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 07:08:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YVBnGzlE7S9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 07:09:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<j1rGHDlEAIeWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 07:09:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62627: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 07:10:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<N6vlIDlEcOw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 07:11:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ZDodJDlE1uoEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 07:11:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<SwxZJDlE7tfF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 07:13:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<5DJKLTlETPgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 07:16:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<bUgrNzlE5rIv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 07:17:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<LIAXOTlEpsN2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-23 07:18:04 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:54182: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 07:18:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RTO8PDlEnrYv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 23 07:18:44 host2 sshd[4133746]: Disconnected from invalid user family 50.232.189.209 port 43736 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.157.5.70
country_id: 2464461
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 102.157.5.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 07:20:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ULXNRTlEjMMv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 07:20:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<RgAcRjlEysqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 07:21:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6mb7SDlE6I9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 07:22:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<A6+nTTlEZpkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 07:23:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<xylRUDlEgLA+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 07:23:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1NKjTzlEjrIv+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 23 07:23:24 host2 sshd[4136378]: Disconnected from invalid user ubuntu 50.232.189.209 port 38840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 23 07:24:38 host2 sshd[4137269]: Disconnected from invalid user test3 50.232.189.209 port 38116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 07:26:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pqNpWTlEnoml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 07:26:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<DHViWjlEdrAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 07:26:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<bO8SXDlEytXIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.38.185
country_id: 290557
description:
2025-11-23 07:27:37 dovecot_plain authenticator failed for (sondum) [5.31.38.185]:46941: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 23 07:28:24 host2 sshd[4139423]: Disconnected from invalid user test4 50.232.189.209 port 35960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 07:28:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<+UWVYzlEqNaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 07:30:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<sDpyZzlE7uA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 07:30:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<rrIUaTlEPrFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 07:30:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<lTW4aTlExjdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 07:31:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<B79NbTlEOuUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 07:33:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<3uKNdTlETqYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 07:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<SEaYdjlEssE+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 07:34:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</qM1djlE+A4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 07:36:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XGHbfTlEJnKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 07:36:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<VhBwfzlElLaWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 07:37:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ihI0gzlE8p8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 07:38:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<2RhnhDlEFq92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 07:38:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<pOeQhjlEMp8v7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.97.71
country_id: 6252001
description:
Nov 23 07:39:20 host2 pure-ftpd[4145404]: (?@135.119.97.71) [INFO] New connection from 135.119.97.71


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 07:39:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<IVdAiTlEVuI+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 07:40:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LdD3jTlELugv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 07:41:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<K588kDlEyLk+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 07:41:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lTEIkTlEOJqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 07:43:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<RxPqlTlEOMpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 07:44:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rC3UmzlEvJwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 07:45:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Mn9WnjlEKIMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 07:46:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<7QumozlEPuc+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 07:48:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<FtAjqjlEjtbIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 07:49:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<fRBQrTlEhMSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 07:50:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<qdZnsTlEirwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 07:51:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<T6PIsjlEONE+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 07:51:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<AzeBtTlEks4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 07:52:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pNX5tjlEKuql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 07:52:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<R1QAuDlETI1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 07:52:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<mv8iuDlEnD9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 07:53:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<qnZRuzlEAsg+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 07:54:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<VBg4wDlElNQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 07:54:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<AI1zwDlEPr0vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.5
country_id: 1733045
description:
2025-11-23 07:55:23 dovecot_login authenticator failed for ([49.124.151.5]) [49.124.151.5]:51098: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-11-23 07:55:58 dovecot_login authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:46676: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 07:57:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<F3BTyDlERrk+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.252
country_id: 6252001
description:
Nov 23 07:57:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V94ByjlEfMzN0h/8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 07:58:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<4d1nzjlEvON2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 07:59:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xdxazzlExIcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 07:59:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</KEL0DlERo0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 07:59:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Mqh10jlECu4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 08:00:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<hCHw0zlEZt6nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-23 08:00:54 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:50276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-23 08:01:01 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:53976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 08:01:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<4z/h1zlE9Nov7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-23 08:02:03 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:22876: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 08:02:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<04JE3DlEnM6PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 08:04:08 host2 sshd[4161139]: Disconnected from invalid user abagail 62.60.131.157 port 35609 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 08:05:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<H/fE5DlE4Nhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 08:04:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<r4Ak4zlEcuY+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 08:04:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<k5Zm4zlECLyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 08:06:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<GF+k6DlEgIYv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov 23 08:06:27 host2 sshd[4162657]: Disconnected from invalid user vpn 103.154.111.3 port 49948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 08:08:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<DiZ47zlEbNsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 08:10:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gfUg9zlEvLKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 08:10:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<J/gy+TlEptnIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov 23 08:10:56 host2 sshd[4166121]: Disconnected from invalid user greg 103.154.111.3 port 36680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 08:12:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<nWaf/jlEjpIEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 08:14:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YyqIBjpEbkZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 08:14:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</1ayBzpEyKdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 08:15:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<dwC8CzpEnkgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 08:15:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<n8usCzpEdJQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 08:15:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<rhIWCjpE8LIv+3xn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.111.3
country_id: 1643084
description:
Nov 23 08:15:34 host2 sshd[4169233]: Disconnected from invalid user p 103.154.111.3 port 42810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 08:16:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<vQWwDDpEULU+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 08:19:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<skKuFjpEwJOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 08:19:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PEoHGTpEMN4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 08:19:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<AsZGGTpENo12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.146.212
country_id: 3469034
description:
Nov 23 08:21:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<info>, method=PLAIN, rip=138.117.146.212, lip=66.85.158.91, TLS, session=<Z0tiHDpEbqCKdZLU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.162
country_id: 798544
description:
Nov 23 08:20:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=178.216.28.162, lip=66.85.158.91, TLS, session=<vj8nGzpEe5ay2Byi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 08:20:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<aI9FHTpEtukv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 08:21:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<F6YHHzpEIMY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 08:21:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<QhXCHzpEWJQ+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 08:21:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<EcxfIDpElN0+PIOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov 23 08:21:54 host2 sshd[4173554]: Disconnected from invalid user solar 103.154.111.3 port 39434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 08:22:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<9VSeITpEzIMv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 08:21:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<+wLFHjpE7p+SOC+J>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.65.211.234
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 95.65.211.234 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 08:23:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pHeoJzpE3NaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 08:24:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<oCqvKjpEAIrF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 08:24:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<9snmKzpEummnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:27:08 host2 sshd[4177236]: Disconnected from invalid user ubuntu 122.165.121.195 port 58570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.26
country_id: 798544
description:
Nov 23 08:26:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=178.219.98.26, lip=66.85.158.91, TLS, session=<XJw1MTpEm8Gy22Ia>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 08:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<WOhiMjpEcIBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.47
country_id: 798544
description:
Nov 23 08:26:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.231.35.47, lip=66.85.158.91, TLS, session=<ghNJMjpEy9dZ5yMv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 08:27:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<QrVgNTpEkN4v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-23 08:28:02 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:40928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 08:31:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<yaSrQTpE9qCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 08:30:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<OdKxQDpEWsUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 08:31:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Q5KSQzpEHsQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 08:33:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<w70ISTpEOomWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 23 08:32:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, session=<hu7WRjpEtpDCpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 08:32:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<vLZaSDpE3uEEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 08:32:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<V4CFSDpEtoPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 08:33:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<uulgSjpElKA+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 08:34:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Cdp7TDpE2LI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 08:35:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<OYlpUTpEYK0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 08:36:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<cWaKUzpEdq0+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 08:36:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<uk5+VjpE/kAvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:36:54 host2 sshd[4183379]: Disconnected from invalid user vijay 122.165.121.195 port 40024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 08:37:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<HkRBVzpECsIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 08:36:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<CS3XVTpEawVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 08:37:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uQ/lWDpEIqxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 08:37:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uqIrWjpEBuE+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 08:39:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<IB6XXjpE3qo+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 08:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<6dOrYjpEKscv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.160
country_id: 3469034
description:
Nov 23 08:40:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=177.130.171.160, lip=66.85.158.91, TLS, session=<4c8RYjpE9Nqxgqug>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 08:40:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zOUyYzpEHssv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.232
country_id: 690791
description:
Nov 23 08:40:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=194.44.78.232, lip=66.85.158.91, TLS, session=<EYk7YzpEEJDCLE7o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 08:40:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zd7kZDpE7od2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:41:27 host2 sshd[4186349]: Disconnected from invalid user beck 122.165.121.195 port 38834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 08:42:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<b0ShajpEdKsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 08:42:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<8AoqazpE9NYv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:44:26 host2 sshd[4188066]: Disconnected from invalid user user 122.165.121.195 port 56618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-11-23 08:44:50 dovecot_plain authenticator failed for (dinouts) [105.114.21.51]:39438: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 08:45:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<RLv5czpEvImPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 08:46:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<4fyxdzpEBuSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 08:48:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ARN1gTpEHM4+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 08:49:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wSqegjpEMsgv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 08:49:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qtorgzpE8NNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 08:49:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<pESKhDpETpGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 08:51:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<HHFNjDpE0I+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 08:52:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ZNLNjDpEFuQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 08:53:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wkGTkTpEpJwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 08:53:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<eevOkjpEjq8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 08:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<LOiOlzpEhq3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 08:57:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DJsaoTpErucvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 08:58:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<VYEBozpEUukrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 08:58:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<y5xFpTpEpwpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:00:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jjtkqTpELI5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:00:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<yw+KrDpE5q8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 09:01:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Y+kfsDpESJ2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:02:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<htiMsDpEUMV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:03:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<0BsVtDpEGtIv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-23 09:04:38 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (chyrowed) [68.52.119.193]:42764: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-23 09:04:40 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:57748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-23 09:04:52 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:60885: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.212.222
country_id: 6252001
description:
2025-11-23 09:04:26 dovecot_login authenticator failed for ([75.109.212.222]) [75.109.212.222]:55334: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:04:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</fdnuTpENsQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 09:05:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<XzxKvDpEXOs+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:05:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<AMvyuzpEAOkv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:06:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rqIBwTpEZJiPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.210.26
country_id: 6252001
description:
Nov 23 09:08:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.40.210.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yWMAxjpEgJwUKNIa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:11:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<O3zQ0DpEJLIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:11:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JhhG0TpEItxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 09:13:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fNCA2TpExIel6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:13:41 host2 sshd[15209]: Disconnected from invalid user abdo 186.233.204.9 port 45760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:14:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<IKdp2zpE1qAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 09:14:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<iGKE3DpETI4+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 09:14:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<0BAr3TpE3IanYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-23 09:16:19 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:50662: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 09:16:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<qeRX5DpEhobIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-23 09:16:42 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:51001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 09:16:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<HiPh5TpEmpkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 09:18:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<3WiZ6zpEqK8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 09:18:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<X4gy6zpETg4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 09:19:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<gHUG7zpEsqIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.67
country_id: 953987
description:
Nov 23 09:19:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.64.37.67, lip=66.85.158.91, TLS, session=<xw6+7jpEBapmQCVD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.179.152
country_id: 6252001
description:
Nov 23 09:21:01 host2 sshd[20601]: Disconnected from invalid user seb 172.173.179.152 port 37946 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.122.204
country_id: 690791
description:
Nov 23 09:20:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=91.228.122.204, lip=66.85.158.91, TLS, session=<yO9s8DpE5o1b5HrM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:21:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<MjAa9zpEJpkv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 09:21:50 host2 sshd[21194]: Disconnected from invalid user admin 2.57.121.112 port 48403 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 09:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QN5M9TpEeBVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 09:22:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<t7lL+TpEHrQ+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<6npC+zpEbtxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:23:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<H/jP+zpEDoov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:23:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A73E/DpEfqd2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:23:59 host2 sshd[22350]: Disconnected from invalid user admin 186.233.204.9 port 50744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 09:24:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<Y0Lv/zpE+rk+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.50
country_id: 226074
description:
Nov 23 09:24:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=196.0.87.50, lip=66.85.158.91, TLS, session=<wrZa/zpEMafEAFcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.134.43
country_id: 3469034
description:
Nov 23 09:24:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=191.53.134.43, lip=66.85.158.91, TLS, session=<numaADtE6uW/NYYr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 09:26:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<oIpsBjtEfog+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 09:26:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<6bGACDtEZLw+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:26:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<G6LMCDtEhLEv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:27:20 host2 sshd[24427]: Disconnected from invalid user deploy 186.233.204.9 port 48672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:28:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<r9QkDztE9NmPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:29:02 host2 sshd[25364]: Disconnected from invalid user ubuntu 186.233.204.9 port 56480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 09:30:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<hAkfFTtEXtuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:30:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<aLa2FTtElLIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 09:31:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<IUI4GztEpso+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.179.152
country_id: 6252001
description:
Nov 23 09:31:58 host2 sshd[27456]: Disconnected from invalid user sandbox 172.173.179.152 port 45424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 09:31:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Ayu7GDtEbJiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:33:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+E+HHztEApwv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 23 09:33:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dSItIjtEctSG0a02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:33:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<K8nwHztEQtdn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 09:34:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<U2GyIztEJnCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:34:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<gTp6JTtEYr8EkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-23 09:35:59 dovecot_plain authenticator failed for (culayse) [65.20.129.67]:55782: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 09:37:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rZwSLztEFOLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 09:37:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<pjkPMTtEsqPF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 09:39:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2KbdNDtEbmsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 09:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<rGTjNjtEMAanYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 23 09:40:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8QysODtEMrVChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 09:40:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<yGv3OTtEboMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 09:40:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8OkEOztEHMorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 09:41:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<eT2RPTtECrCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:42:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uZH5QTtEnoEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 09:43:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WVNvRTtELx1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 09:43:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<9u35RTtEQJU+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.109
country_id: 6252001
description:
Nov 23 09:43:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q+lURjtEYMGTuYRt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<bV8SRDtEEosv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 09:43:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<9rh6RDtEdqg+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-23 09:43:26 dovecot_plain authenticator failed for (psonvic) [12.150.243.22]:17501: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:44:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<VhWcSTtEjJp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:46:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+LjFTTtEMtJA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fc0uUjtEoNui2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 09:47:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<7mNtVDtEFo8+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:48:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<IXfDVjtEeOOi2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 09:48:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<O7LXVjtEWLY+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-23 09:48:40 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:42759: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.196.85
country_id: 3175395
description:
2025-11-23 09:48:58 dovecot_login authenticator failed for net-2-40-196-85.cust.vodafonedsl.it [2.40.196.85]:48711: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:48:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<xRtoWDtE2J4v+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:49:28 dovecot_login authenticator failed for (Z2l0sN63L) [178.16.54.32]:57346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:50:16 dovecot_login authenticator failed for (if36tdMob) [178.16.54.32]:51568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:50:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<q2N8XTtE0NuPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:51:25 dovecot_login authenticator failed for (MRcRBU) [178.16.54.32]:50261: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.218
country_id: 6252001
description:
Nov 23 09:51:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() syscall failed: Invalid argument (no auth attempts in 0 secs): user=<>, rip=20.169.104.218, lip=66.85.158.91, TLS handshaking: SSL_accept() syscall failed: Invalid argument, session=<0JzMYjtE2ocUqWja>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.34
country_id: 2635167
description:
Nov 23 09:53:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.34, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<fu+7aTtEHYa594ki>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.234
country_id: 2635167
description:
Nov 23 09:53:13 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.234, lip=66.85.158.91, TLS, session=<OrmqZztE54xX7LDq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.31
country_id: 2635167
description:
Nov 23 09:53:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.31, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6XvAZztE9bZX7LAf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.87
country_id: 6252001
description:
Nov 23 09:53:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.87, lip=66.85.158.92, TLS, session=<rN4raDtEkO/G6xhX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.4
country_id: 2635167
description:
Nov 23 09:54:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.4, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<8GDCbTtEV5BX7LAE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:55:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+9T+bTtEvoUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:54:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1w7eajtETKRn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.17
country_id: 2635167
description:
Nov 23 09:54:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.17, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<l/fGaztEY5C594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:54:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS, session=<a/tJbDtEnOai2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:55:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<U+GwbztE3MkEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:55:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<VeribztEurwv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.2
country_id: 2635167
description:
Nov 23 09:56:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7xe3cTtE2cy594kC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 09:55:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<REn7bjtEFmCYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Nov 23 09:55:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<+9W9bztE59BX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.15
country_id: 2635167
description:
Nov 23 09:56:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.15, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<L3i0cztED7NX7LAP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 09:56:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<mUxwdDtE/p8+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.195.68.63
country_id: 3017382
description:
[2025-11-23 09:56:49 +0530] info [cpaneld] 78.195.68.63 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.52
country_id: 3175395
description:
Nov 23 09:57:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.197.9.52, lip=66.85.158.91, TLS, session=<HdyddjtEp+G5xQk0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Nov 23 09:57:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<oyepdztEmblX7LAl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.155.145
country_id: 3469034
description:
[2025-11-23 09:57:15 +0530] info [whostmgrd] 191.5.155.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.40.160.59
country_id: 2017370
description:
[2025-11-23 09:57:24 +0530] info [cpaneld] 31.40.160.59 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.197.21
country_id: 2510769
description:
[2025-11-23 09:57:36 +0530] info [cpaneld] 79.117.197.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.152.184.145
country_id: 2921044
description:
[2025-11-23 09:57:38 +0530] info [cpaneld] 88.152.184.145 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.27
country_id: 732800
description:
Nov 23 09:57:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.215.27, lip=66.85.158.91, TLS, session=<nI2zdztEaIm5/9cb>


