# incident

plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 17:17:40 host2 sshd[1455669]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.185
country_id: 1880251
description:
Nov 24 17:17:24 host2 sshd[1455406]: Disconnected from invalid user teamspeak 101.47.143.185 port 43792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 17:17:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<BaNDulVEnpul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.123.222
country_id: 3469034
description:
Nov 24 17:18:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=192.140.123.222, lip=66.85.158.91, TLS, session=<4AkwvlVEoIbAjHve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 17:19:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<fL9YwlVE4IePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.208
country_id: 798544
description:
Nov 24 17:19:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=46.227.39.208, lip=66.85.158.91, TLS, session=<5V9Nv1VE/bcu4yfQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.39.160.124
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 193.39.160.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.237.220.68
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2.237.220.68 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.187.244.254
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.187.244.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 155.186.144.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 155.186.144.69 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.68.13.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.68.13.209 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.76.188.172
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 203.76.188.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.1.42.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.1.42.216 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.218.125.29
country_id: 1036973
description:
2025-11-24 17:21:19 dovecot_plain authenticator failed for ([89.116.164.85]) [197.218.125.29]:25761: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 17:22:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<rF5+zVVENOI+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.34
country_id: 6252001
description:
Nov 24 17:22:07 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.34, lip=66.85.158.92, session=<dEzjylVEQqss3Lki>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 17:22:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<LSZczFVE0Ok+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov 24 17:23:40 host2 sshd[1459356]: Disconnected from invalid user sysop 197.5.145.150 port 50238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 24 17:24:55 host2 sshd[1460172]: Disconnected from invalid user userm 118.26.36.195 port 39874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov 24 17:24:43 host2 sshd[1460089]: Disconnected from invalid user frappe 159.223.183.233 port 44262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 17:25:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hFCT2FVEEpQ+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.116.114.116
country_id: 3469034
description:
2025-11-24 17:25:31 dovecot_plain authenticator failed for ([89.116.164.85]) [179.116.114.116]:34216: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 17:25:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<9tlF11VEaLcI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.101.170.154
country_id: 1733045
description:
2025-11-24 17:25:46 dovecot_plain authenticator failed for ([89.116.164.85]) [118.101.170.154]:14562: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 17:26:21 host2 sshd[1461219]: Disconnected from invalid user admin 2.57.121.112 port 63057 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov 24 17:27:16 host2 sshd[1461796]: Disconnected from invalid user user 197.5.145.150 port 41878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 17:27:44 host2 sshd[1462027]: Disconnected from invalid user admin 2.57.121.112 port 42737 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 24 17:27:50 host2 sshd[1462099]: Disconnected from invalid user ubuntu 118.26.36.195 port 35558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 17:27:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<i+FH3FVE8MSWXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.150
country_id: 2464461
description:
Nov 24 17:28:21 host2 sshd[1462538]: Disconnected from invalid user steam 197.5.145.150 port 45706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.150
country_id: 2464461
description:
Nov 24 17:29:23 host2 sshd[1463330]: Disconnected from invalid user gerrit 197.5.145.150 port 60926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 17:29:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<wa0G5VVEVLcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 17:29:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<k6Xv5VVEQoAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Nov 24 17:29:57 host2 sshd[1463808]: Disconnected from invalid user cinema 68.183.88.186 port 33746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.134.154.55
country_id: 1880251
description:
Nov 24 17:30:40 host2 sshd[1464544]: Disconnected from invalid user devuser 103.134.154.55 port 47152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 17:30:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<VLj76VVE8M/F8xBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Nov 24 17:31:39 host2 sshd[1465077]: Disconnected from invalid user andy 118.26.36.195 port 41212 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.191.229.124
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.191.229.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.158.168.66
country_id: 2400553
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 41.158.168.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.232.118
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.167.232.118 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.168.124.121
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 14.168.124.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.61.35.242
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.61.35.242 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.183.233
country_id: 6252001
description:
Nov 24 17:32:59 host2 sshd[1465754]: Disconnected from invalid user tester 159.223.183.233 port 59458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-24 17:33:55 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:33752: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.13.168.219
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.13.168.219 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 17:33:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<I2ZH8lVEKtIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 17:33:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<5GpE8lVEDq0+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-24 17:33:36 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:37189: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.120.22
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 193.233.120.22 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.134.154.55
country_id: 1880251
description:
Nov 24 17:34:26 host2 sshd[1466706]: Disconnected from invalid user test 103.134.154.55 port 49708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.215.180
country_id: 1210997
description:
2025-11-24 17:34:04 dovecot_plain authenticator failed for ([89.116.164.85]) [103.87.215.180]:43484: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 24 17:35:28 host2 sshd[1467475]: Disconnected from invalid user astra 107.175.70.59 port 55566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov 24 17:36:07 host2 sshd[1467830]: Disconnected from invalid user steam 159.223.183.233 port 47260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 24 17:36:35 host2 sshd[1468137]: Disconnected from invalid user g 107.175.70.59 port 58430 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 17:37:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<LcO+AVZE+Jwv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 17:37:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<JFaLAlZEZspA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 17:37:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<yaD8AlZElLErpAFm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Nov 24 17:38:34 host2 sshd[1469327]: Disconnected from invalid user opc 67.10.185.103 port 34848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.134.154.55
country_id: 1880251
description:
Nov 24 17:39:31 host2 sshd[1470140]: Disconnected from invalid user github 103.134.154.55 port 55150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Nov 24 17:39:50 host2 sshd[1470305]: Disconnected from invalid user maarch 67.10.185.103 port 37686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 17:40:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<+AgbC1ZE2rjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 17:40:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<oIQiDVZEvPkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 17:40:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HADTDVZEWJtn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.134.154.55
country_id: 1880251
description:
Nov 24 17:41:36 host2 sshd[1471419]: Disconnected from invalid user devops 103.134.154.55 port 33634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 17:42:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<nmWEE1ZEXJN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 17:42:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dA6OE1ZEQBFniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.134.154.55
country_id: 1880251
description:
Nov 24 17:43:26 host2 sshd[1472401]: Disconnected from invalid user victor 103.134.154.55 port 39240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.70
country_id: 1269750
description:
Nov 24 17:43:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=103.207.4.70, lip=66.85.158.91, TLS, session=<RVcXF1ZEx8tnzwRG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.190.96.234
country_id: 3469034
description:
Nov 24 17:44:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.190.96.234, lip=66.85.158.91, TLS, session=<zMpUGFZEK82zvmDq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 17:46:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<j/hsIVZEHLWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 17:47:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<OVNuJlZEoOmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 17:50:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<pRa0MVZEnMA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 17:51:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<DrA/NVZE3NUv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-24 17:53:49 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:58107: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-24 17:53:35 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38945: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Nov 24 17:54:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<nTsPQFZEdiBChJmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 17:54:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<y0euP1ZEeqUI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 17:58:15 host2 sshd[1483887]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 17:59:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<dOuFUFZEmIwv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 17:59:47 host2 sshd[1485204]: Disconnected from invalid user admin 2.57.121.112 port 50298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 18:01:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<2okOWFZEgudA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.161
country_id: 3895114
description:
Nov 24 18:02:09 host2 sshd[1487408]: Disconnected from invalid user manager 201.186.40.161 port 42914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.161
country_id: 3895114
description:
Nov 24 18:03:46 host2 sshd[1488761]: Disconnected from invalid user service 201.186.40.161 port 45022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 24 18:03:36 host2 sshd[1488672]: Disconnected from invalid user leo 85.209.134.43 port 56350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 24 18:04:36 host2 sshd[1489490]: Disconnected from invalid user huawei 85.209.134.43 port 55544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 24 18:03:52 host2 sshd[1488841]: Disconnected from invalid user huawei 23.91.96.70 port 49144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Nov 24 18:05:46 host2 sshd[1490454]: Disconnected from invalid user es 40.82.214.8 port 40962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.161
country_id: 3895114
description:
Nov 24 18:05:31 host2 sshd[1490316]: Disconnected from invalid user user7 201.186.40.161 port 47150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 24 18:05:33 host2 sshd[1490355]: Disconnected from invalid user service 85.209.134.43 port 34016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 18:05:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ozs+Z1ZEhosv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 18:06:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<Muv8Z1ZEJpc+PIco>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.209.134.43
country_id: 6252001
description:
Nov 24 18:06:30 host2 sshd[1491241]: Disconnected from invalid user tv 85.209.134.43 port 55446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 18:06:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<noS5aVZEVlEvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 24 18:05:48 host2 sshd[1490502]: Disconnected from invalid user cat 23.91.96.70 port 46298 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 24 18:06:55 host2 pure-ftpd[1491554]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 18:08:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QMNnb1ZE7Rdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 18:08:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<AxQgcFZEbK0rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.161
country_id: 3895114
description:
Nov 24 18:08:36 host2 sshd[1492652]: Disconnected from invalid user controlm 201.186.40.161 port 51324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Nov 24 18:09:17 host2 sshd[1493060]: Disconnected from invalid user local 40.82.214.8 port 47682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 18:09:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=</tNEdFZEgp9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 18:09:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<fDKCdFZEJq8+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 18:10:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<8yipd1ZEBIjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 18:11:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<JVdcelZETKA+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.82.214.8
country_id: 2077456
description:
Nov 24 18:10:54 host2 sshd[1494320]: Disconnected from invalid user apagar 40.82.214.8 port 35250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 24 18:13:17 host2 sshd[1495775]: Disconnected from invalid user leo 23.91.96.70 port 37158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 18:13:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<bUK6gFZEwqQ+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 18:14:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<RLalhFZEyo8v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 18:14:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Ou3ahVZEAqp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 18:14:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<h6ishlZE5IU+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 18:15:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<CGwLilZEfK+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 18:15:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<got0i1ZEwOKPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-24 18:21:02 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:51691: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-11-24 18:21:34 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:54174: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-11-24 18:23:04 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:39324: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 18:23:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<i9LMpFZEFJSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 18:23:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<yefoplZERNUFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.252
country_id: 2510769
description:
2025-11-24 18:22:49 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:58308: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 18:24:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4oDRqFZE5MIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 18:24:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<7FFxqlZEQqc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 18:24:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<TWFuqFZE6JMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 18:24:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<BbVbq1ZE1LFA44h6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.96.93.204
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 92.96.93.204 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 18:26:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<+tGkr1ZEFI0v7bxd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 218.111.147.110
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 218.111.147.110 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.186.227.236
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.186.227.236 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.132.4.76
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.132.4.76 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.44.195
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.75.44.195 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.47.30.85
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 1.47.30.85 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.5.51.135
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 139.5.51.135 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 18:28:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<i8U8uFZElxxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 18:29:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mH6Tu1ZEIOI+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 24 18:30:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3oV4v1ZEhf/CpRCk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 18:32:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<ZTw9xlZE1ocvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 18:34:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<XcSazVZEgOgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 18:34:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<RdeNzlZECt0v+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 18:37:27 host2 sshd[1510738]: Disconnected from invalid user user 2.57.121.25 port 30761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 18:38:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PwSe3VZEjpRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 18:39:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<WOb43lZEgKkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 18:41:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<5iHG5lZEYNfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 18:44:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<9mS38FZEeqOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 18:44:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<D/dH8VZEKMTF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 18:44:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Z7DW8VZEbr6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.233
country_id: 953987
description:
Nov 24 18:44:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.45.233, lip=66.85.158.91, TLS, session=<Uvzb8FZE/aFmQC3p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 18:43:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<LLEJ71ZEEJs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-24 18:45:38 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:39257: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.234.187.5
country_id: 2510769
description:
Nov 24 18:44:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.234.187.5, lip=66.85.158.91, TLS, session=<xO8P8lZE6ai56rsF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-24 18:45:29 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:55758: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Nov 24 18:46:36 host2 sshd[1517023]: Disconnected from invalid user user 154.221.27.234 port 56104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 18:46:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ew9B+lZErMd2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.27.234
country_id: 1819730
description:
Nov 24 18:48:29 host2 sshd[1518112]: Disconnected from invalid user vlad 154.221.27.234 port 43399 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 18:47:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<W6qR/VZE6olA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 18:49:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oF7pAVdEhiBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 18:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xf5yBldEnK6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 18:51:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<qkX3CldELq0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 18:52:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<9PThDVdEdNEv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 18:53:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VvaSEVdEWIII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 18:52:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<aldtD1dE9ss+PIcf>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 91.170.247.160
country_id: 3017382
description:
Nov 24 18:54:04 host2 sshd[1521859]: Disconnecting authenticating user root 91.170.247.160 port 5430: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 91.170.247.160
country_id: 3017382
description:
Nov 24 18:54:04 host2 sshd[1521859]: error: maximum authentication attempts exceeded for root from 91.170.247.160 port 5430 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.170.247.160
country_id: 3017382
description:
Nov 24 18:54:26 host2 sshd[1522617]: Disconnecting invalid user admin 91.170.247.160 port 2348: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 18:55:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<E9CuGFdEMOUv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Nov 24 18:56:54 host2 sshd[1524264]: Disconnected from invalid user jrodrig 154.221.27.234 port 36321 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 18:57:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<3FZxIFdEGp0+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 18:58:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<N3CsIVdExP0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.156
country_id: 3865483
description:
Nov 24 19:01:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=45.238.106.156, lip=66.85.158.91, TLS, session=<WfD5LFdE+80t7mqc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.130
country_id: 3175395
description:
Nov 24 19:01:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.8.130, lip=66.85.158.91, TLS, session=<GusvLldE78a5xQiC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 19:02:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<s2SBMVdEEtcv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 19:09:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<S2VBSVdEZMtn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 19:09:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gKi/SldEoSVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 19:10:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7AdFTldEcKUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 19:10:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<XpPvTldEvN5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 19:11:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Wni9UVdEjOWPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.248.23
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.201.248.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.227.187.237
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.227.187.237 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.226.203.27
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.226.203.27 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.233.65.95
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.233.65.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.17.180.156
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.17.180.156 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.71.65.32
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.71.65.32 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.231.37
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.53.231.37 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 19:12:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<w68nVFdE1L3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 19:13:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<SOI1WFdEpIIFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 19:13:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0C34WFdEoMyl6LP6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 19:14:39 host2 sshd[1537214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.47.148.161
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 163.47.148.161 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.100.203
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.236.100.203 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.97.36.189
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.97.36.189 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.33.215
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.33.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 211.203.36.9
country_id: 1835841
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 211.203.36.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.252.229
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 62.201.252.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.10.163.210
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 1.10.163.210 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 19:15:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<af2VYVdEgOYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 19:17:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Ip8zaFdEMN+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 19:17:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<bGcqaFdE3tg+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 19:18:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<w5RzaVdEPpcv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 19:18:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<E5M4aldELN0v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 24 19:19:08 host2 sshd[1540640]: Disconnected from invalid user csgoserver 4.211.84.189 port 40998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 19:19:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<eG4xbldEGut2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 19:20:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<QphWcVdEYsM+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.95.231.172
country_id: 3144096
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.95.231.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.247.33.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 63.247.33.60 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.215.97.29
country_id: 285570
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 62.215.97.29 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.213.22
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.211.213.22 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.59.211.96
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.59.211.96 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.2.197
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.5.2.197 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 19:22:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<2NI3eFdE+t4I04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 24 19:21:48 host2 sshd[1542639]: Disconnected from invalid user aj 4.211.84.189 port 52780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.79.68.87
country_id: 6251999
description:
Nov 24 19:22:08 host2 sshd[1542962]: Disconnected from invalid user invitado 51.79.68.87 port 43124 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 24 19:22:56 host2 sshd[1543759]: Disconnected from invalid user taiga 4.211.84.189 port 57308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 19:23:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MqplfFdEHIQvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.181.68.29
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.181.68.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.188.131.14
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.188.131.14 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 19:24:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<HkORgVdEHJI+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.214.102.78
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.214.102.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.249.153.171
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.249.153.171 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.226.86.248
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.226.86.248 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.219.153.50
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.219.153.50 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.153.235.135
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 85.153.235.135 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 19:27:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<0rsRildEiJo+PIcd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.79.68.87
country_id: 6251999
description:
Nov 24 19:27:11 host2 sshd[1546796]: Disconnected from invalid user ali 51.79.68.87 port 47668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 24 19:27:55 host2 sshd[1547398]: Disconnected from invalid user tomcat 4.211.84.189 port 57926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Nov 24 19:29:15 host2 sshd[1548198]: Disconnected from invalid user admin 4.211.84.189 port 36640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 19:30:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<3aktlFdEQAhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 19:30:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<1EvplFdEjMUv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.79.68.87
country_id: 6251999
description:
Nov 24 19:29:51 host2 sshd[1548557]: Disconnected from invalid user aj 51.79.68.87 port 56668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 19:29:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+2UZlFdEHoc+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.43.184.187
country_id: 2963597
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.43.184.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.119.71.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 137.119.71.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.188.113.2
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 193.188.113.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 19:33:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<zlPuoFdEdtRA44h6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.10.8.214
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.10.8.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.22.138.112
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.22.138.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.144.11.139
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.144.11.139 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.116.160.165
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 90.116.160.165 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.100
country_id: 953987
description:
Nov 24 19:34:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.129.51.100, lip=66.85.158.91, TLS, session=<SEoRoldEfJBmgTNk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.81
country_id: 3469034
description:
Nov 24 19:34:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.44.71.81, lip=66.85.158.91, TLS, session=<cKFMo1dElOyxLEdR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 19:36:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<iya5qVdEat0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 19:37:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jvc3r1dEnr9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.21.237.130
country_id: 458258
description:
Nov 24 19:37:38 host2 sshd[1553904]: Disconnected from invalid user administrator 213.21.237.130 port 35204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-24 19:38:19 dovecot_login authenticator failed for ([161.81.25.86]) [161.81.25.86]:53758: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Nov 24 19:38:45 host2 sshd[1554669]: Disconnected from invalid user posiflex 45.78.221.78 port 59136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-24 19:38:05 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:60864: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 19:38:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<LNihs1dEGtePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 19:40:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<njzGuFdE+J8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 19:41:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<51juvVdE1ufIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 19:42:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NdTNwFdEpMIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 19:42:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<EvFCv1dEFOyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 19:44:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<zeROyFdEvpE+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 19:44:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hfp+yFdEwJw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 19:44:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<6/GtyFdEcIEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 19:44:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<q6SVyVdEcM6WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.78
country_id: 1880251
description:
Nov 24 19:45:26 host2 sshd[1560017]: Disconnected from invalid user ftptest 45.78.221.78 port 42486 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 19:45:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<GHghzFdEquY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 19:46:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<Jnppz1dE+JY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 19:46:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<+9Jwz1dE1i0vTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.77.47.166
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.77.47.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.65.229.99
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.65.229.99 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 19:47:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<aUtA0ldEfqA+PIcq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.193.88.236
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.193.88.236 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.180.10.17
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 135.180.10.17 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.220.200.160
country_id: 1036973
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 41.220.200.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.42.243.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.42.243.239 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-24 19:48:38 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:43574: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.21.237.130
country_id: 458258
description:
Nov 24 19:49:22 host2 sshd[1562635]: Disconnected from invalid user work 213.21.237.130 port 59970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-11-24 19:48:58 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:54254: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.178.144.10
country_id: 3202326
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.178.144.10 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.254.81.162
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.254.81.162 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.61.211.46
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 27.61.211.46 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.171.249.17
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 183.171.249.17 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.152.247.49
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.152.247.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.214.107.72
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 81.214.107.72 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 19:51:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<3nGw4FdESoA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 19:51:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<JYon4VdElJ4+PIcq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.238.188.76
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.238.188.76 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 19:50:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KJ503ldE+Axniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 19:50:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<UM7W3ldEas0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 19:50:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<izDc3ldEIJp2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.21.237.130
country_id: 458258
description:
Nov 24 19:53:08 host2 sshd[1565346]: Disconnected from invalid user vyos 213.21.237.130 port 58052 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 19:55:18 host2 sshd[1567675]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.21.237.130
country_id: 458258
description:
Nov 24 19:54:59 host2 sshd[1567209]: Disconnected from invalid user toor 213.21.237.130 port 45806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 19:54:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<NE9Y7VdEXtA+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 19:56:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<R3Y88VdEDK4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 19:55:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ixiy8FdEBORA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 19:58:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<rXIs+VdEJLQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 19:58:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<BoCK+VdEcqjF8xBa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-11-24 19:59:31 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:40492: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 19:59:58 host2 sshd[1570412]: Disconnected from invalid user admin 2.57.121.112 port 56802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-24 20:00:30 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:54855: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Nov 24 20:00:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.51, lip=66.85.158.92, TLS: Connection closed, session=<dG22AlhE/kenXpIz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-24 20:00:56 dovecot_login authenticator failed for (nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:50208: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 20:04:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<qkEZD1hESIcv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 20:05:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jUhvE1hEPuhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 20:06:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<wy9PFlhEwNiPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Nov 24 20:07:12 host2 sshd[1576382]: Disconnected from invalid user tecnopos 45.78.221.78 port 46752 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.53.32.111
country_id: 1733045
description:
[2025-11-24 20:07:47 +0530] info [cpaneld] 60.53.32.111 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 20:08:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<R60qHFhE+GwvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.244.226.185
country_id: 1643084
description:
[2025-11-24 20:08:24 +0530] info [cpaneld] 180.244.226.185 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.70.158.193
country_id: 3469034
description:
[2025-11-24 20:07:50 +0530] info [cpaneld] 45.70.158.193 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.110.34.34
country_id: 3508796
description:
[2025-11-24 20:07:53 +0530] info [cpaneld] 190.110.34.34 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.187.228.80
country_id: 1269750
description:
[2025-11-24 20:08:13 +0530] info [cpaneld] 103.187.228.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.120.176.138
country_id: 3865483
description:
[2025-11-24 20:08:15 +0530] info [cpaneld] 190.120.176.138 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 20:10:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<XiXFJFhEvporpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 20:10:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<u/egJVhEeoGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 20:10:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<R4OSJlhEAug+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 20:11:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<tJMNKVhE9I3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 20:11:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wSwPKVhEnNov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 20:11:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GGyQKVhECghniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 20:12:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<GbDIK1hESMWWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.98
country_id: 2635167
description:
Nov 24 20:14:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.98, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<XLTtM1hENdgjy9Ji>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 20:16:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<fACyOFhE7qUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 20:18:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wHltQFhETqxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 20:18:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<BtctQVhEapk+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 20:19:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<OI7cRVhEULsI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.98
country_id: 2635167
description:
Nov 24 20:21:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.98, lip=66.85.158.91, TLS, session=<Vv4gS1hEmO8jy9Ji>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.116.246
country_id: 6252001
description:
Nov 24 20:21:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.116.246, lip=66.85.158.92, TLS, session=<7CbzTVhE5LcofHT2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.220.169.24
country_id: 3017382
description:
[2025-11-24 20:23:06 +0530] info [cpaneld] 81.220.169.24 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.10.101.119
country_id: 1643084
description:
[2025-11-24 20:22:53 +0530] info [whostmgrd] 182.10.101.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.98.168.113
country_id: 290557
description:
[2025-11-24 20:22:58 +0530] info [cpaneld] 86.98.168.113 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.108.212.52
country_id: 1605651
description:
[2025-11-24 20:22:34 +0530] info [cpaneld] 101.108.212.52 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.49.1.113
country_id: 290557
description:
[2025-11-24 20:22:38 +0530] info [cpaneld] 2.49.1.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.255.116
country_id: 1210997
description:
[2025-11-24 20:22:40 +0530] info [cpaneld] 103.78.255.116 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 20:22:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<jU3KUFhEnqR2wSaf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.92.7.33
country_id: 2264397
description:
[2025-11-24 20:23:14 +0530] info [cpaneld] 95.92.7.33 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 20:26:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<WN/PXFhEoqIv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 20:26:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<aUX6XFhENNAv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.186.171.52
country_id: 6252001
description:
Nov 24 20:26:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.186.171.52, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FDCYXVhEcMA0uqs0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Nov 24 20:26:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<byKqXFhEXwrI7VWg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.33
country_id: 3469034
description:
Nov 24 20:26:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.249.33, lip=66.85.158.91, TLS, session=<RCz0XVhElMW60fkh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.83.228.111
country_id: 3865483
description:
[2025-11-24 20:29:38 +0530] info [cpaneld] 191.83.228.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 20:29:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NJFPaVhERrwvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.164.254.9
country_id: 2542007
description:
[2025-11-24 20:29:40 +0530] info [cpaneld] 160.164.254.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.184.124.19
country_id: 953987
description:
[2025-11-24 20:29:49 +0530] info [whostmgrd] 197.184.124.19 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.141.74.121
country_id: 3017382
description:
[2025-11-24 20:29:54 +0530] info [cpaneld] 176.141.74.121 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.14.130
country_id: 2635167
description:
[2025-11-24 20:29:56 +0530] info [cpaneld] 45.148.14.130 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.185.130.87
country_id: 1168579
description:
[2025-11-24 20:30:02 +0530] info [cpaneld] 182.185.130.87 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 101.128.101.169
country_id: 1643084
description:
[2025-11-24 20:29:30 +0530] info [cpaneld] 101.128.101.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-24 20:30:18 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 20:32:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<9CyAdFhEPBZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 20:32:47 host2 sshd[1592783]: Disconnected from invalid user admin 2.57.121.112 port 21176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.93
country_id: 1880251
description:
Nov 24 20:32:30 host2 sshd[1592607]: Disconnected from invalid user mika 45.78.193.93 port 33998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 20:33:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<r/CEeFhESouPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 20:33:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BALweFhEgLJn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Nov 24 20:34:56 host2 pure-ftpd[1593973]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 20:36:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<eGbLgVhEXI4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 20:38:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rlF9h1hEvMQv+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.182.100.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.182.100.79 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.77.121
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.241.77.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-11-24 20:38:20 dovecot_login authenticator failed for (nsg-corporate-209.240.186.122.airtel.in) [27.123.97.62]:53360: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.1.253.27
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.1.253.27 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.96.94
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 182.232.96.94 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-24 20:38:39 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:49680: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.164.165.23
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.164.165.23 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.92.69.1
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.92.69.1 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.76.218.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.76.218.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.228.110.60
country_id: 617790
description:
Nov 24 20:39:46 host2 pure-ftpd[1597246]: (?@91.228.110.60) [INFO] New connection from 91.228.110.60


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 20:39:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<u/8yjFhE+q2WXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 174.138.81.32
country_id: 6252001
description:
Nov 24 20:39:29 host2 pure-ftpd[1596848]: (?@174.138.81.32) [INFO] New connection from 174.138.81.32


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 20:39:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Q83bjFhE/I+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 20:40:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jDlEkVhEOOhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 20:41:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<FWYnk1hExpUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 20:42:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ivnklVhEVsLIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.78.217
country_id: 2921044
description:
Nov 24 20:42:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.78.217, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<T5iyl1hEoZxA4k7Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-24 20:44:05 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:58117: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.185.200
country_id: 2921044
description:
Nov 24 20:43:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.185.200, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SG6gmlhEkgQuZbnI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.243.7.4
country_id: 2635167
description:
2025-11-24 20:44:16 dovecot_login authenticator failed for host-89-243-7-4.as13285.net [89.243.7.4]:33611: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.206
country_id: 6251999
description:
Nov 24 20:45:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.206, lip=66.85.158.91, TLS: Connection closed, session=<wqQTolhEuJyUcdbO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.93
country_id: 1880251
description:
Nov 24 20:47:06 host2 sshd[1601851]: Disconnected from invalid user guest123 45.78.193.93 port 42886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 20:47:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<6KQIq1hE9KgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 20:48:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<BmJMq1hExIkv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.101
country_id: 3469034
description:
Nov 24 20:49:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.72.101, lip=66.85.158.91, TLS, session=<Ege+rlhE9si7eEhl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.81
country_id: 732800
description:
Nov 24 20:49:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.253.159.81, lip=66.85.158.91, TLS, session=<vUgBsFhE3a25/Z9R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 20:51:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<YP7dt1hEEqUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 20:53:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<gJMgwFhE8pAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 20:53:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<z7TPvlhExBlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 20:54:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<jJ7qw1hEwNd2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.152
country_id: 2264397
description:
Nov 24 20:55:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.152, lip=66.85.158.92, session=<HDZpxFhEq50tnIGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 20:56:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<ADWZylhEes4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 21:00:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<E+oh2VhEQJuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 21:03:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<x2dU4VhEhJNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 21:02:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<AhKu4FhExLJn9M4G>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-24 21:03:14 H=([87.120.36.32]) [87.120.36.32]:60612 F=<montanosa@bre1.com> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 21:03:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<KgvH41hEuq4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 21:06:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<XpcB7lhEBKmWXx+e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 21:08:51 host2 sshd[1616688]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 21:08:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<F8dJ9FhEUIml6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.176.79
country_id: 6252001
description:
Nov 24 21:08:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.75.176.79, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vr4o9lhE0KYiS7BP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.176.79
country_id: 6252001
description:
Nov 24 21:09:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=34.75.176.79, lip=66.85.158.91, session=<KXgU+FhE8qUiS7BP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.196.100.4
country_id: 6252001
description:
Nov 24 21:09:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.196.100.4, lip=66.85.158.91, session=<i9pK+FhE6uAjxGQE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 21:09:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6aqZ+FhEUrAv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.148.127.114
country_id: 6252001
description:
Nov 24 21:09:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=34.148.127.114, lip=66.85.158.91, session=<BDj3+FhEJskilH9y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-24 21:10:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49798: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 21:11:59 host2 sshd[1618974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 21:12:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<qxVOBFlEGMrIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 21:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<Hgs1AllE6orF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 21:12:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<xYutAllEgpErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.245.13.243
country_id: 1269750
description:
Nov 24 21:13:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=43.245.13.243, lip=66.85.158.91, TLS, session=<Jmi5BVlEgdgr9Q3z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 21:13:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<vu3HB1lEmh5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.120
country_id: 953987
description:
Nov 24 21:13:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.40.120, lip=66.85.158.91, TLS, session=<73ByBFlE6cBmQCh4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 21:13:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<QPGgBVlEamkvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.32
country_id: 6252001
description:
Nov 24 21:14:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.32, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<u6RmCllEGs2i2JYg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 21:15:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ulnZDFlEBJUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 21:16:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<eLZSEllEYLsv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 24 21:19:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jUfkGllEnLxKUi8C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-24 21:19:47 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:60018: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-24 21:20:08 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:35123: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 21:20:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Vb9QH1lEcO0v+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-24 21:20:34 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:54228: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.32
country_id: 6252001
description:
Nov 24 21:20:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.32, lip=66.85.158.92, TLS, session=<LrVQIFlEfv6i2JYg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 21:25:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Ah6DMFlEaItA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 21:26:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lW9kNllENu2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 21:27:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<lIQpN1lENo52wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:28:16 host2 sshd[1631159]: Disconnected from invalid user radio 105.28.108.165 port 58012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 21:28:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<zr9fO1lELo8+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 21:28:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<qQ3OPFlEtJgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-24 21:30:14 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:33644: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-24 21:30:42 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:43654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 21:30:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<7bPoQ1lEdrgv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-11-24 21:30:12 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:40138: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-11-24 21:30:36 dovecot_login authenticator failed for ([182.72.102.106]) [182.72.102.106]:55258: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:30:57 host2 sshd[1633255]: Disconnected from invalid user scanner 138.197.123.123 port 56992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 21:32:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6x2ySFlE6OFn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:32:05 host2 sshd[1633955]: Disconnected from invalid user node 138.197.123.123 port 42958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 21:31:11 host2 sshd[1633388]: Disconnected from invalid user user 2.57.121.25 port 28198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-24 21:31:17 dovecot_login authenticator failed for ([189.44.133.238]) [189.44.133.238]:45281: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:31:28 host2 sshd[1633547]: Disconnected from invalid user localhost 45.246.33.169 port 38054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:32:27 host2 sshd[1634163]: Disconnected from invalid user temp 105.28.108.165 port 60988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 21:34:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<o48LUFlE1KGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 21:34:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<MP1IUFlESoE+PIOI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 24 21:34:27 host2 sshd[1635640]: Disconnected from invalid user ghost 82.65.43.136 port 40706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 21:34:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YZZsUVlEaCNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 21:34:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pEr3UllE4D8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-24 21:36:01 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50296: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:35:18 host2 sshd[1636767]: Disconnected from invalid user bitwarden 45.246.33.169 port 55602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:35:27 host2 sshd[1636874]: Disconnected from invalid user user8 138.197.123.123 port 39886 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:35:49 host2 sshd[1637099]: Disconnected from invalid user bitwarden 105.28.108.165 port 37836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-24 21:36:17 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:42626: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 24 21:36:40 host2 sshd[1637742]: Disconnected from invalid user root1 82.65.43.136 port 51904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 21:36:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<Hm4FWllElsUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 21:37:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mbIeXVlE7uyl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:37:23 host2 sshd[1638230]: Disconnected from invalid user user1 105.28.108.165 port 40836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:38:53 host2 sshd[1639316]: Disconnected from invalid user user 105.28.108.165 port 43044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:38:28 host2 sshd[1639074]: Disconnected from invalid user botuser 45.246.33.169 port 47532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 24 21:40:03 host2 sshd[1640325]: Disconnected from invalid user user5 82.65.43.136 port 51022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:39:40 host2 sshd[1640008]: Disconnected from invalid user toor 138.197.123.123 port 45142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:39:58 host2 sshd[1640157]: Disconnected from invalid user pivpn 45.246.33.169 port 53640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:40:23 host2 sshd[1640725]: Disconnected from invalid user production 105.28.108.165 port 46106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 24 21:41:10 host2 sshd[1641224]: Disconnected from invalid user vyos 82.65.43.136 port 50722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 21:41:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<DvmeaVlEorwFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:41:35 host2 sshd[1641426]: Disconnected from invalid user mc 45.246.33.169 port 38866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:41:50 host2 sshd[1641572]: Disconnected from invalid user deploy 138.197.123.123 port 38122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Nov 24 21:41:57 host2 sshd[1641616]: Disconnected from invalid user valheim 105.28.108.165 port 48940 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 21:42:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<IxjkbVlEwIEI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Nov 24 21:42:54 host2 sshd[1642276]: Disconnected from invalid user git 138.197.123.123 port 55154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 21:43:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<U+jGcFlE1o0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 21:43:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<L/POcFlE3svIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.33.169
country_id: 357994
description:
Nov 24 21:43:18 host2 sshd[1642587]: Disconnected from invalid user valheim 45.246.33.169 port 45770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 21:46:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ZSEFfllERt0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 21:47:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<8WBJgFlEeoRA44h6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.57.141
country_id: 6252001
description:
Nov 24 21:48:42 host2 pure-ftpd[1659158]: (?@20.106.57.141) [INFO] New connection from 20.106.57.141


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.67.168
country_id: 2921044
description:
Nov 24 21:50:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.67.168, lip=66.85.158.91, TLS handshaking: Connection closed, session=<43ndi1lEGAal6EOo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.99
country_id: 6252001
description:
Nov 24 21:50:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.99, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Gsnwi1lEX19APpxj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.94
country_id: 6252001
description:
Nov 24 21:51:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Q4UDjVlEjOVAPpxe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Nov 24 21:50:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, session=<illpillEsMNAPpxQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.94
country_id: 6252001
description:
Nov 24 21:51:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.94, lip=66.85.158.92, TLS: Connection closed, session=<YTuNjVlEXpRAPpxe>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.179.252
country_id: 6252001
description:
Nov 24 21:51:20 host2 pure-ftpd[1661421]: (?@40.124.179.252) [INFO] New connection from 40.124.179.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 21:53:01 host2 sshd[1662444]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 21:52:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<+RcpkVlEWp0v7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.131
country_id: 2635167
description:
Nov 24 21:52:25 host2 pure-ftpd[1662044]: (?@87.236.176.131) [INFO] New connection from 87.236.176.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 21:53:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<b4CHlFlE8I2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 21:53:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<8moRlllE2IIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 21:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<iuHgmllEpSdniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-24 21:56:15 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:55626: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-24 21:56:53 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:45183: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 21:57:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<dKBBollEVJM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 21:57:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<+TvOollERr4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 21:57:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MC38ollEgpgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 21:59:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<GqL/qllEruR2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 24 21:59:32 host2 sshd[1667419]: Disconnected from invalid user g 38.213.63.12 port 47202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 22:01:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Yw7WsllERqSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 22:01:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<hRA1s1lEIu5n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 24 22:02:01 host2 sshd[1669268]: Disconnected from invalid user temp 38.213.63.12 port 50204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 22:02:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<tfvGtFlE0Lc+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 24 22:03:13 host2 sshd[1670335]: Disconnected from invalid user ftpuser 38.213.63.12 port 42102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 22:07:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<M1K1xVlENOul6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 24 22:06:56 host2 sshd[1672721]: Disconnected from invalid user afa 38.213.63.12 port 39686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 22:09:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<M7P6z1lEbt4I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 22:10:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ZhZj0VlEsKNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.21
country_id: 3175395
description:
Nov 24 22:13:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<info>, method=PLAIN, rip=185.15.170.21, lip=66.85.158.91, TLS, session=<g/dL3FlEB+65D6oV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 22:13:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<bLp33llE4IkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.100.137.167
country_id: 3469034
description:
Nov 24 22:13:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=131.100.137.167, lip=66.85.158.91, TLS, session=<eHb62llEgMWDZImn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 22:13:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<pdVA3VlENMYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 22:13:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<+haU3VlEDtYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 22:14:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<cDjy31lEiMTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 22:15:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<osjm5FlEoCtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 22:17:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<xXeH7FlE8Ksv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-24 22:18:01 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:35636: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-24 22:18:16 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:59480: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 22:19:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<CzyF8FlETNsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 22:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zwJa81lEOqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 22:19:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</iko8VlEsFcvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.242.217
country_id: 1269750
description:
Nov 24 22:23:04 host2 sshd[1682684]: Disconnected from invalid user cesar 143.110.242.217 port 54004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.186.225
country_id: 2921044
description:
Nov 24 22:25:08 host2 sshd[1684288]: Disconnected from invalid user mark 138.124.186.225 port 41042 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.218.248.146
country_id: 6252001
description:
Nov 24 22:27:33 host2 pure-ftpd[1685811]: (?@13.218.248.146) [INFO] New connection from 13.218.248.146


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.186.225
country_id: 2921044
description:
Nov 24 22:28:32 host2 sshd[1686298]: Disconnected from invalid user bayu 138.124.186.225 port 59314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 22:30:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<AkXcF1pEmLuWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.242.217
country_id: 1269750
description:
Nov 24 22:29:09 host2 sshd[1686662]: Disconnected from invalid user bayu 143.110.242.217 port 45288 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Nov 24 22:29:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.122, lip=66.85.158.91, TLS: Connection closed, session=<MgFoF1pEjENBMQF6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.130
country_id: 6252001
description:
Nov 24 22:29:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.130, lip=66.85.158.91, session=<8pKrFlpEw6RBMQGC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.126
country_id: 6252001
description:
Nov 24 22:29:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3r8PF1pEachAPpx+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 24 22:30:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fkcjGFpEgJ5APpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 24 22:30:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS: Connection closed, session=<ZsnZGFpEgk1APpx6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.242.217
country_id: 1269750
description:
Nov 24 22:30:22 host2 sshd[1687588]: Disconnected from invalid user taiga 143.110.242.217 port 44890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 22:31:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<o+XUHlpESMd2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.186.225
country_id: 2921044
description:
Nov 24 22:31:37 host2 sshd[1688258]: Disconnected from invalid user ts3 138.124.186.225 port 38608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.242.217
country_id: 1269750
description:
Nov 24 22:31:39 host2 sshd[1688267]: Disconnected from invalid user elena 143.110.242.217 port 37974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.90.166
country_id: 6252001
description:
Nov 24 22:33:06 host2 sshd[1689083]: Disconnected from invalid user kodi 43.130.90.166 port 22528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 22:32:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YuU0IlpEYO1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 22:33:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<sAKfIlpErMZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 22:33:18 host2 sshd[1689164]: Disconnected from invalid user infant 62.60.131.157 port 5984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Nov 24 22:34:07 host2 sshd[1689580]: Disconnected from invalid user elena 124.7.227.98 port 49011 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Nov 24 22:34:58 host2 sshd[1690095]: Disconnected from invalid user mqm 20.212.241.39 port 57718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 22:35:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6NLkKVpEZpov7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Nov 24 22:35:10 host2 sshd[1690412]: Disconnected from invalid user cesar 124.7.227.98 port 56826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.90.166
country_id: 6252001
description:
Nov 24 22:35:58 host2 sshd[1690982]: Disconnected from invalid user daniel 43.130.90.166 port 11776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 22:36:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<smqwL1pEJzJniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 24 22:36:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<QX1RMFpE+ExChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 22:36:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JzSMMFpEMMCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 22:37:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<GILMMVpEvMwI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 24 22:38:14 host2 sshd[1692381]: Disconnected from invalid user testftp 205.185.115.224 port 42034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 22:38:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zy2JNVpElt0v+3xn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.90.166
country_id: 6252001
description:
Nov 24 22:38:30 host2 sshd[1692528]: Disconnected from invalid user test 43.130.90.166 port 49408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Nov 24 22:38:53 host2 sshd[1692766]: Disconnected from invalid user reza 20.212.241.39 port 53524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 24 22:39:42 host2 sshd[1693446]: Disconnected from invalid user shiny 205.185.115.224 port 42914 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 22:40:53 host2 sshd[1694437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Nov 24 22:40:46 host2 sshd[1694374]: Disconnected from invalid user ajay 20.212.241.39 port 55216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.90.166
country_id: 6252001
description:
Nov 24 22:41:03 host2 sshd[1694584]: Disconnected from invalid user admin1234 43.130.90.166 port 17152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 22:40:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<0pP/PFpEwM4v+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 24 22:41:00 host2 sshd[1694526]: Disconnected from invalid user bitwarden 205.185.115.224 port 43782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 22:41:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<TV2GP1pEuBovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.28.101.14
country_id: 3865483
description:
Nov 24 22:40:06 host2 sshd[1693865]: Disconnected from invalid user testftp 181.28.101.14 port 41746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 24 22:42:15 host2 sshd[1695165]: Disconnected from invalid user deploy 205.185.115.224 port 44650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Nov 24 22:42:34 host2 sshd[1695281]: Disconnected from invalid user appuser 20.212.241.39 port 44552 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov 24 22:42:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<SZY2RVpEMlu4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov 24 22:43:06 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<RQrXRlpEOAm4aYtG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.28.101.14
country_id: 3865483
description:
Nov 24 22:43:10 host2 sshd[1695639]: Disconnected from invalid user shiny 181.28.101.14 port 47384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Nov 24 22:44:14 host2 sshd[1696200]: Disconnected from invalid user shiny 20.212.241.39 port 40940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Nov 24 22:44:16 host2 sshd[1696210]: Disconnected from invalid user share 124.7.227.98 port 48865 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 22:44:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<nABxTFpEmMUv+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 24 22:44:51 host2 pure-ftpd[1696781]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 24 22:44:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS: Connection closed, session=<Dik7TVpEBOSUccE7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 24 22:45:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4ucrTlpEdO2UccE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 22:45:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+CLnTlpEroYrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Nov 24 22:46:36 host2 sshd[1698355]: Disconnected from invalid user bayu 124.7.227.98 port 64453 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 22:46:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<O8hsU1pE+sOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 22:46:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<Lvm6U1pE7IvIMGRT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.28.101.14
country_id: 3865483
description:
Nov 24 22:46:10 host2 sshd[1698156]: Disconnected from invalid user reza 181.28.101.14 port 52340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Nov 24 22:46:12 host2 sshd[1698176]: Disconnected from invalid user teamspeak 45.78.226.65 port 43262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.7.227.98
country_id: 1269750
description:
Nov 24 22:47:44 host2 sshd[1698931]: Disconnected from invalid user cloud 124.7.227.98 port 37321 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.134
country_id: 6252001
description:
Nov 24 22:51:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.134, lip=66.85.158.91, TLS: Connection closed, session=<kgY4Y1pEwrbHLZqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Nov 24 22:51:14 host2 sshd[1701204]: Disconnected from invalid user s 45.78.226.65 port 35496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 22:51:44 host2 sshd[1701498]: Disconnected from invalid user user 2.57.121.25 port 42328 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-24 22:52:39 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.254
country_id: 1880251
description:
Nov 24 22:53:17 host2 sshd[1702311]: Disconnected from invalid user user10 45.78.204.254 port 50362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 22:55:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Tx1OdFpEhNBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 22:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<AvbDdFpEbOsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 22:57:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<AkqBe1pEKjhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 22:58:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Z9cOfVpEPo+WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.65
country_id: 1880251
description:
Nov 24 22:58:32 host2 sshd[1705926]: Disconnected from invalid user zhangsan 45.78.226.65 port 52862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.71
country_id: 3865483
description:
Nov 24 22:58:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=186.1.224.71, lip=66.85.158.91, TLS, session=<DONafVpEpaa6AeBH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.120.137
country_id: 798544
description:
Nov 24 22:58:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.231.120.137, lip=66.85.158.91, TLS, session=<FnqfflpEjMxb53iJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 22:59:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<a6Ggf1pEdtgv+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.195
country_id: 6252001
description:
Nov 24 22:59:16 host2 pure-ftpd[1706407]: (?@147.185.132.195) [INFO] New connection from 147.185.132.195


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.254
country_id: 1880251
description:
Nov 24 23:00:42 host2 sshd[1707463]: Disconnected from invalid user administrator 45.78.204.254 port 38108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 23:02:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<nY2Ei1pEaJwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 23:03:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<rdwwj1pElNFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 23:03:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P1Erj1pE9rkI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.24
country_id: 6251999
description:
Nov 24 23:03:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.24, lip=66.85.158.92, session=<A2APkFpEWJaUcdUY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 23:04:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<q2XKklpErp52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 23:05:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<7lVnl1pEcMYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 23:06:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<DfXdm1pEzKel6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.204.254
country_id: 1880251
description:
Nov 24 23:08:15 host2 sshd[1712128]: Disconnected from invalid user bitwarden 45.78.204.254 port 52154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 23:10:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Iqc8qVpENrAv+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.252
country_id: 6252001
description:
Nov 24 23:11:37 host2 pure-ftpd[1714390]: (?@205.210.31.252) [INFO] New connection from 205.210.31.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 24 23:12:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.91, TLS: Connection closed, session=<hdyJsFpELseUcdOD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 24 23:12:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<3rymsFpEGKWUcdUX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 23:13:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<sV7us1pE2OiPbtX3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.107
country_id: 6252001
description:
Nov 24 23:14:01 host2 pure-ftpd[1715733]: (?@64.62.197.107) [INFO] New connection from 64.62.197.107


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-11-24 23:16:15 H=([87.120.36.32]) [87.120.36.32]:60972 F=<montanosa@bre1.com> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 23:16:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<29MCv1pECoMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 23:16:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<0I0yv1pEnMEv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 23:18:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<lwNnxlpEHpfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 23:19:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ovwWyFpEqtlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 23:19:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SCZzyFpE9j9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 23:20:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<UDqGy1pEgLEv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Nov 24 23:21:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, session=<jX2GzlpEDkdAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 23:21:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<YH2SzlpE9ps+PIOK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 23:21:42 host2 sshd[1720303]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Nov 24 23:21:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS: Connection closed, session=<LodWz1pEzlRAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 23:23:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<r6As2FpEMuYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.72
country_id: 3469034
description:
Nov 24 23:26:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@weeratrading.com>, method=PLAIN, rip=170.80.41.72, lip=66.85.158.91, TLS, session=<noTi3lpE/pCqUClI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 23:26:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xaIH4VpEBt+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.81
country_id: 3996063
description:
Nov 24 23:26:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.122.97.81, lip=66.85.158.91, TLS, session=<hahk4FpEJeyKemFR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 23:29:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<QcQY7lpEJKkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 23:31:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<XWYv9FpErr4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 23:33:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<FfY6+VpETqBn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 24 23:34:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<l2Yh/lpEHk64affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.86
country_id: 6252001
description:
Nov 24 23:35:51 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.86, lip=66.85.158.92, session=<zoyDA1tEwuGs7ORW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 23:35:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<rIbeA1tEVsV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 23:37:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<b9THB1tEkMal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 23:37:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<u92LCFtEeJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 23:38:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<pH+uC1tEHtQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 23:39:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<kd/bEVtEWMvF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 23:41:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<mPvrFVtEPKaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 23:41:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SNoJFltE7Utniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 23:41:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<sWTVGFtEcKUv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 23:42:21 host2 sshd[1734191]: Disconnected from invalid user admin 2.57.121.112 port 53934 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 23:42:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<IZNYHFtECpNA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 23:44:36 host2 sshd[1735957]: Disconnected from invalid user jarvis 62.60.131.157 port 27355 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 23:45:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vz/IJFtEsLcvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.206
country_id: 6251999
description:
Nov 24 23:46:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.214.206, lip=66.85.158.92, TLS: Connection closed, session=<v82QKFtEMJuUcdbO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 23:47:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hbnsK1tEmIcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 23:50:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<FZE4NltEapPIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov 24 23:50:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.228, lip=66.85.158.92, TLS: Connection closed, session=<uE/QN1tE0qyUcdLk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Nov 24 23:53:39 host2 sshd[1742325]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 31068


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 23:54:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<oIUWRltEdMqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-24 23:55:42 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:52724: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-11-24 23:55:28 dovecot_login authenticator failed for (scz-190-104-24-00006.tigo.bo) [190.104.24.6]:39284: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 23:56:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<YMLzTVtEQJ8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 23:57:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<QvDXUVtEqscv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Nov 24 23:58:25 host2 sshd[1746043]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 48454


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 23:59:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<OiniWFtE6ucv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 00:03:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<LzOUZFtEtspn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 00:02:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Ygz3Y1tEgA9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 00:03:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<OnW2ZVtEIuIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 00:04:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dIIxaFtE0oQv+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 00:05:46 host2 sshd[1751813]: Disconnected from invalid user telnet 2.57.121.112 port 61356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 25 00:06:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NOKyb1tEerBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 00:06:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<j7/scVtErNMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 00:07:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<pJcbdFtETNt2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 00:07:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<bDlvdFtENuCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 00:08:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nDxYeFtEdJWPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Nov 25 00:10:25 host2 sshd[1754643]: Disconnected from invalid user odoo15 118.194.250.11 port 51326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Nov 25 00:14:03 host2 sshd[1757594]: Disconnected from invalid user toto 118.194.250.11 port 56880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.168.41
country_id: 3469034
description:
Nov 25 00:16:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=177.136.168.41, lip=66.85.158.91, TLS, session=<F1BAlVtE/rSxiKgp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.11
country_id: 1605651
description:
Nov 25 00:16:38 host2 sshd[1759272]: Disconnected from invalid user autrede 118.194.250.11 port 49960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.67
country_id: 798544
description:
Nov 25 00:17:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=77.65.142.67, lip=66.85.158.91, TLS, session=<pTVhlltEItJNQY5D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Nov 25 00:17:50 host2 sshd[1759962]: Disconnected from invalid user local 118.194.250.11 port 45142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 00:17:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<js7ImVtElo8rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Nov 25 00:19:12 host2 sshd[1760721]: Disconnected from invalid user frappe 118.194.250.11 port 40054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 25 00:19:23 host2 sshd[1760878]: Disconnected from invalid user daniel 125.31.2.160 port 59108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 00:20:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<IMvlo1tE7tDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 00:21:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<E/QXpVtEvN4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 00:23:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Qp8erFtEpuyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 00:24:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2YPdsVtEuxtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 00:25:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<sxCzs1tEAJQI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 00:25:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<wYvKs1tE8oQv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov 25 00:25:44 host2 sshd[1765370]: Disconnected from invalid user in 172.245.177.148 port 59064 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 00:25:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<GUFgtltEhtcv+yXY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.177.148
country_id: 6252001
description:
Nov 25 00:26:49 host2 sshd[1765993]: Disconnected from invalid user elasticsearch 172.245.177.148 port 57936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 25 00:27:06 host2 sshd[1766125]: Disconnected from invalid user in 125.31.2.160 port 35970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov 25 00:27:50 host2 sshd[1766622]: Disconnected from invalid user kafka 172.245.177.148 port 56800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 00:28:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xL0JwFtE8ncvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Nov 25 00:30:08 host2 sshd[1768225]: Disconnected from invalid user sammy 125.31.2.160 port 42226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 00:30:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dWXgx1tELN0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 00:33:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5AHp0FtENLdn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 25 00:34:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<Q3mP1VtEItySOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 25 00:35:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<rE8/2FtEWqkFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 00:35:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qRE02ltEVtqPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.237.191
country_id: 2921044
description:
Nov 25 00:35:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.209.237.191, lip=66.85.158.91, session=<5/CL11tE/XGG0e2/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.22.187
country_id: 2921044
description:
Nov 25 00:35:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.22.187, lip=66.85.158.91, session=<Hy2R11tEkvho+Ba7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 00:37:38 host2 sshd[1772672]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.166
country_id: 2635167
description:
Nov 25 00:37:10 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS, session=<S0rC3ltE39G594mm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 00:37:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</kJ+4VtEHLSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 00:38:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6iy841tECJx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.9.142
country_id: 2395170
description:
Nov 25 00:42:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=41.74.9.142, lip=66.85.158.91, TLS, session=<CVQx8ltEaM0pSgmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 00:42:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<uwiK8FtELNov7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Nov 25 00:43:32 host2 pure-ftpd[1776345]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.197
country_id: 3469034
description:
Nov 25 00:43:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.255.206.197, lip=66.85.158.91, TLS, session=<NOhW81tEKoCK/87F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 00:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<aDQsAFxEiitniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 00:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<rfSJAlxEesMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 00:49:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hW8fCVxE/pcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 00:50:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jm5gD1xEpqEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 00:51:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<mdO8ElxEWJzIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 00:51:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<c11vE1xESseWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Nov 25 00:52:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.244, lip=66.85.158.92, TLS, session=<T5G4FFxECP/N0h/0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 25 00:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<fafNGlxE4pTF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 00:53:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<iSdoGlxE3ooI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 00:54:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<oPsqHFxE6uYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 00:57:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZtkpKFxELscv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 01:02:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<6OhiOlxE3L2PbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.18
country_id: 6252001
description:
Nov 25 01:03:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.33.109.18, lip=66.85.158.92, session=<uF8xPFxE5d4tIW0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 01:04:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<sKoRP1xEcrVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 01:04:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<knmWP1xE7N0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 01:08:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7WssTlxEKjpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 01:08:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uzVgTlxELOal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 01:09:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<FwjpUFxE0r4v+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.232
country_id: 6252001
description:
Nov 25 01:09:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.232, lip=66.85.158.91, TLS, session=</k7OUlxEAPzN0h/o>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 60.147.213.98
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 60.147.213.98: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 01:10:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<x0sBVVxEPp4+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 01:10:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<MqS4VVxEkq12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 01:13:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jXyIX1xEDpgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.113
country_id: 3469034
description:
Nov 25 01:15:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=187.120.72.113, lip=66.85.158.91, TLS, session=<1+v6Z1xETby7eEhx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.77
country_id: 798544
description:
Nov 25 01:16:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.98.77, lip=66.85.158.91, TLS, session=<PeBDaVxEocCy22JN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 01:17:58 host2 sshd[1798923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 25 01:20:08 host2 sshd[1800313]: Disconnected from invalid user invoices 159.65.185.221 port 37976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 25 01:20:14 host2 sshd[1800398]: Disconnected from invalid user conectar 110.93.250.15 port 30116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 01:20:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<q/1CeVxEEJWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 01:20:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<mzRTelxEkqArpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 01:22:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<G2cGglxEYoEI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 25 01:22:36 host2 sshd[1801940]: Disconnected from invalid user user5 110.93.250.15 port 40027 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 01:22:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<a5+MgVxEDIkv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 01:23:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wCAyg1xEquHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 01:24:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Le4Xh1xEhLIv+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 25 01:25:12 host2 sshd[1803567]: Disconnected from invalid user elk 110.93.250.15 port 53862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 01:26:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<96nAjlxETo8v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 25 01:27:44 host2 sshd[1804993]: Disconnected from invalid user mm 110.93.250.15 port 4229 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 25 01:27:55 host2 sshd[1805083]: Disconnected from invalid user botuser 152.32.206.160 port 42934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 25 01:27:59 host2 sshd[1805103]: Disconnected from invalid user toto 102.211.152.138 port 55690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 25 01:28:49 host2 sshd[1805554]: Disconnected from invalid user ark 159.65.185.221 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 25 01:31:05 host2 sshd[1807250]: Disconnected from invalid user ts3 152.32.206.160 port 47956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 01:30:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kBgPnFxED0dniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 25 01:30:11 host2 sshd[1806466]: Disconnected from invalid user q 159.65.185.221 port 45536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 25 01:30:13 host2 sshd[1806522]: Disconnected from invalid user ark 110.93.250.15 port 18025 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 01:30:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<q5ZunFxE/quPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 01:30:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<hyqknlxEYokv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 25 01:32:58 host2 sshd[1808509]: Disconnected from invalid user ubuntu 152.32.206.160 port 38684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.142.62
country_id: 1269750
description:
2025-11-25 01:32:16 dovecot_login authenticator failed for (abts-mum-dynamic-062.142.179.122.airtelbroadband.in) [122.179.142.62]:44680: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 25 01:32:30 host2 sshd[1808028]: Disconnected from invalid user teste 102.211.152.138 port 41120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-25 01:32:56 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:32990: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 25 01:33:54 host2 sshd[1809080]: Disconnected from invalid user jacob 102.211.152.138 port 57886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.185.221
country_id: 6252001
description:
Nov 25 01:34:08 host2 sshd[1809202]: Disconnected from invalid user elk 159.65.185.221 port 59202 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 25 01:34:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<R0S8q1xEwKk+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 25 01:34:52 host2 sshd[1809539]: Disconnected from invalid user copia 152.32.206.160 port 46826 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 01:35:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<suGnrVxEhItn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 25 01:35:50 host2 sshd[1810222]: Disconnected from invalid user dspace 152.32.206.160 port 35744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 01:35:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<cluosFxEGr8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 25 01:36:51 host2 sshd[1810847]: Disconnected from invalid user vpn 102.211.152.138 port 35162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.142.42
country_id: 2963597
description:
Nov 25 01:38:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=89.106.142.42, lip=66.85.158.91, TLS, session=<+Zf+uVxELqRZao4q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.111.124.169
country_id: 798544
description:
Nov 25 01:39:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.111.124.169, lip=66.85.158.91, TLS, session=<vlQYu1xEQsKwb3yp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 01:39:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sS1mvVxEloel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 01:41:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<gVL1w1xE2r52wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 01:41:19 host2 sshd[1813618]: Disconnected from invalid user admin 2.57.121.112 port 42011 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 25 01:42:56 host2 pure-ftpd[1814530]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 01:48:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<j+oy31xEYpwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 01:49:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+vvs31xE9IOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 01:48:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<61mP3lxEkLAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 01:49:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Qq+e4FxExpYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 01:50:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PabK41xETuUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 01:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QR595FxE0Atniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 01:50:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<ZNap5FxEQKcrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-11-25 01:51:59 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4965: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 01:51:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<6FS451xEZNYv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 01:51:27 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.25.183.157
country_id: 1605651
description:
2025-11-25 01:51:46 dovecot_login authenticator failed for node-109p.pool-125-25.dynamic.nt-isp.net [125.25.183.157]:58882: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 01:52:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<bYqM7FxEGJDIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.184.248
country_id: 2921044
description:
Nov 25 01:54:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.184.248, lip=66.85.158.91, TLS, session=<pik681xEHrMuZbj4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Nov 25 01:55:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.255, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QSgM91xExsrN0h//>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 01:55:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<W44L+FxEDsuPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Nov 25 01:56:20 host2 sshd[1824624]: Disconnected from invalid user rstudio 103.193.178.68 port 59276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.68
country_id: 1643084
description:
Nov 25 01:57:49 host2 sshd[1825638]: Disconnected from invalid user vagrant 103.193.178.68 port 43630 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.107
country_id: 6252001
description:
Nov 25 01:58:20 host2 pure-ftpd[1826153]: (?@198.235.24.107) [INFO] New connection from 198.235.24.107


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 01:58:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1cFwAl1ExoMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Nov 25 01:59:12 host2 sshd[1826645]: Disconnected from invalid user hello 103.193.178.68 port 41436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.85.26.230
country_id: 6252001
description:
Nov 25 02:00:28 host2 sshd[1827362]: Invalid user cloudtourssrilan_travel from 66.85.26.230 port 60664


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.68
country_id: 1643084
description:
Nov 25 02:00:38 host2 sshd[1827790]: Disconnected from invalid user halo 103.193.178.68 port 51146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 02:02:24 host2 sshd[1828970]: Disconnected from invalid user user 2.57.121.25 port 50437 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 02:03:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Y5fTE11E6qJn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Nov 25 02:04:42 host2 sshd[1830931]: Disconnected from invalid user elasticsearch 34.66.223.68 port 50572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.85.26.230
country_id: 6252001
description:
Nov 25 02:05:04 host2 sshd[1830995]: Invalid user cloudtourssrilan_travel from 66.85.26.230 port 65500


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 25 02:05:37 host2 sshd[1831664]: Disconnected from invalid user max 139.59.231.45 port 32824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 25 02:05:59 host2 sshd[1831857]: Disconnected from invalid user es 139.59.66.39 port 54954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 25 02:08:55 host2 sshd[1833712]: Disconnected from invalid user openbravo 139.59.231.45 port 45488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-25 02:08:10 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:65478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-25 02:08:27 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:45514: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-25 02:08:44 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:49367: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.177
country_id: 6252001
description:
Nov 25 02:09:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VOjUKF1EyNOTuYSx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 02:10:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<gwsgLl1EtNV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 02:11:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kFlfLl1EzIgv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 25 02:10:14 host2 sshd[1834721]: Disconnected from invalid user kiosk 139.59.231.45 port 33158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 25 02:10:16 host2 sshd[1834735]: Disconnected from invalid user user1 128.199.157.145 port 39936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 02:10:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<zT4XLV1ETM2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 02:10:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<JYnNLV1EIhdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 25 02:11:28 host2 sshd[1835411]: Disconnected from invalid user daniel 139.59.231.45 port 56266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Nov 25 02:11:33 host2 sshd[1835472]: Disconnected from invalid user in 34.66.223.68 port 35112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 02:11:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<TZNgMV1EWJEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 02:13:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<C2a8NV1EzoYv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 02:12:12 host2 sshd[1835856]: Disconnected from invalid user admin 2.57.121.112 port 63123 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Nov 25 02:14:51 host2 sshd[1838105]: Disconnected from invalid user max 34.66.223.68 port 46572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 25 02:14:21 host2 sshd[1837826]: Disconnected from invalid user vagrant 139.59.66.39 port 57886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 02:15:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Fs4yPV1EkqMv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Nov 25 02:15:15 host2 sshd[1838546]: Disconnected from invalid user vagrant 128.199.157.145 port 34802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 02:16:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<lMYoQ11EpNoI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov 25 02:17:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.172, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u6LlRF1Ej9vN0h+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 02:18:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xpKGR11Ems+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 02:19:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<U6MOTF1EVq0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 02:19:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<tOf0TV1E9KiPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 02:19:55 host2 sshd[1841422]: Disconnected from invalid user nick 62.60.131.157 port 57885 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 25 02:20:15 host2 sshd[1841663]: Disconnected from invalid user daniel 172.173.178.67 port 37938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.85.26.230
country_id: 6252001
description:
Nov 25 02:21:35 host2 sshd[1842499]: Invalid user cloudtourssrilan_travel from 66.85.26.230 port 65379


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 02:21:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<p/iUVF1EZuHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 02:21:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<lpXRVF1E2pgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 02:27:16 host2 sshd[1846729]: Disconnected from invalid user admin 2.57.121.112 port 58259 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 25 02:30:32 host2 sshd[1848949]: Disconnected from invalid user elasticsearch 172.173.178.67 port 33540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 02:30:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<seP1c11EryRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 02:32:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Bx37eV1EKsFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 02:32:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<dLfhe11EEK8v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 02:33:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6VIVfl1EDs0v7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 02:34:19 host2 sshd[1851113]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 02:35:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<svu8hl1E7N4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.98
country_id: 226074
description:
Nov 25 02:36:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=196.0.107.98, lip=66.85.158.91, TLS, session=<RrUEh11EYszEAGti>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.253
country_id: 3469034
description:
Nov 25 02:36:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.129.253, lip=66.85.158.91, TLS, session=<9+VTiF1EHoi/NYH9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.134
country_id: 1861060
description:
Nov 25 02:38:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=118.194.236.134, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UF7tkF1EvMd2wuyG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.134
country_id: 1861060
description:
Nov 25 02:39:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.194.236.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7F/Fk11EwsZ2wuyG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 02:39:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<LDLWkl1EDq0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 02:40:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6GP7l11EpMl2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 02:42:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<IZaWnV1E2s4I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 02:42:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<b4SUnl1ERJ6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 02:43:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MKHtoV1ErKKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 02:44:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<ETDTpl1EaPEvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 25 02:45:35 host2 sshd[1858935]: Disconnected from invalid user castle 172.173.178.67 port 37898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 02:46:59 host2 sshd[1860077]: Disconnected from invalid user user 2.57.121.25 port 11180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 02:47:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Tq00sV1EYIKWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-25 02:48:52 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:40556: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 02:48:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<srCmtV1EBLQrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-25 02:48:26 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:47945: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 02:50:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YmtTul1EPDBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 02:51:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<DXH5vl1E0ILIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 02:53:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<uakwxV1EvN4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 02:55:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<7P1wzF1EBscv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.134
country_id: 1861060
description:
Nov 25 02:55:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=118.194.236.134, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<HOFAzV1EOMh2wuyG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.236.134
country_id: 1861060
description:
Nov 25 02:56:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=118.194.236.134, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kQkc0F1EmrR2wuyG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.138.34
country_id: 2921044
description:
Nov 25 02:58:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.138.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VZb81l1EQralmooi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 02:58:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<pOmI2V1ExMgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2025-11-25 03:00:39 dovecot_login authenticator failed for (abts-north-static-233.69.160.122.airtelbroadband.in) [122.160.69.233]:46036: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-25 03:01:02 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:41934: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 03:01:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JIAv5F1E1MBn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 03:01:05 host2 sshd[1869296]: Disconnected from invalid user admin 2.57.121.112 port 49990 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 03:03:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<vEih611Eergv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 03:07:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VA5f+F1EQsII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 03:07:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TrRf911EuuaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 03:07:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<hI4R+F1EiDAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 03:10:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<C2TTAl5E4Dxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.175
country_id: 6290252
description:
Nov 25 03:10:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.207.35.175, lip=66.85.158.91, TLS, session=<kAjhAl5EJcZtzyOv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.111
country_id: 798544
description:
Nov 25 03:10:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=109.125.247.111, lip=66.85.158.91, TLS, session=<UDbHAV5Em8htffdv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 03:11:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<NTQxBl5EjJV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 03:13:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<OEVlDl5ENoIv+3xn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 03:14:36 host2 sshd[1878133]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 03:14:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<1UU8EV5EIJyl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Nov 25 03:14:52 host2 sshd[1878215]: Disconnected from invalid user client 41.216.177.55 port 58544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.177.55
country_id: 1643084
description:
Nov 25 03:16:34 host2 sshd[1879239]: Disconnected from invalid user steam 41.216.177.55 port 60868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 03:17:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6bwRG15E3uwv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-25 03:17:31 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:33620: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-25 03:17:38 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:39589: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 03:18:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<k//hHV5ERpuWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.220
country_id: 6252001
description:
Nov 25 03:18:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JW8DHl5EpcfG6xjc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Nov 25 03:18:10 host2 sshd[1880369]: Disconnected from invalid user jrodrig 41.216.177.55 port 51662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 03:19:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<q359IV5EVrsrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 03:19:55 host2 sshd[1881393]: Disconnected from invalid user user 2.57.121.25 port 12568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 03:21:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<YiM3K15EurvIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-25 03:22:34 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:50046: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 03:22:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<SdWjL15EArQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-25 03:22:17 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:40343: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 03:26:04 host2 sshd[1885371]: Disconnected from invalid user ulysses 62.60.131.157 port 31015 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.18.98.87
country_id: 660013
description:
Nov 25 03:26:11 host2 sshd[1885413]: Disconnected from invalid user admin 203.18.98.87 port 44268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.18.98.87
country_id: 660013
description:
Nov 25 03:28:41 host2 sshd[1886838]: Disconnected from invalid user ftpadmin 203.18.98.87 port 34018 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 03:29:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<lL4rSF5EcrAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 03:29:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JGCqRV5EPMQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 25 03:29:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<i3/CRl5E/soFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 03:31:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TpYaTV5EC0tniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 03:31:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rZQtTV5Eco+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 03:31:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<w4wdTV5EVLJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 03:33:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VpvCU15EhMII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.18
country_id: 2510769
description:
Nov 25 03:33:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=185.74.243.18, lip=66.85.158.91, TLS, session=<hLBhU15EJuK5SvMS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.85.171.68
country_id: 732800
description:
Nov 25 03:33:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=77.85.171.68, lip=66.85.158.91, TLS, session=<0cB7VF5E5spNVatE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 03:34:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<K7BxWF5E1Jkv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 03:38:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6E1tZV5EiNUv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.138.34
country_id: 2921044
description:
Nov 25 03:38:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=165.154.138.34, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8NY9Zl5EyLqlmooi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 03:43:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<KZxceF5E0uV2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 25 03:43:53 host2 sshd[1896332]: Disconnected from invalid user rahul 118.193.61.170 port 41434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 03:47:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5+6shl5EWOKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 03:47:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ecGDiF5EEJ4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 03:48:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<pGVCjF5EyumWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 25 03:49:48 host2 sshd[1903176]: Disconnected from invalid user oracle 164.90.225.61 port 44688 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 25 03:49:20 host2 sshd[1902868]: Disconnected from invalid user tidb 118.193.61.170 port 43092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 03:49:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<irYPjl5ElMIrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Nov 25 03:50:21 host2 sshd[1903736]: Disconnected from invalid user installer 45.169.194.5 port 36284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 25 03:52:00 host2 sshd[1905231]: Disconnected from invalid user root1 118.193.61.170 port 47156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 03:51:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vyEJll5EGpwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 03:52:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yy+pmF5EkBFniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 25 03:53:00 host2 sshd[1906106]: Disconnected from invalid user tidb 164.90.225.61 port 48904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 03:53:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<czerm15EKqXIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 25 03:53:12 host2 sshd[1906308]: Disconnected from invalid user minecraft 118.193.61.170 port 47756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 03:54:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<xMfVn15Eetgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 03:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<qUraoV5EDKEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 03:55:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hnxFo15EqNKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Nov 25 03:56:18 host2 sshd[1909621]: Disconnected from invalid user user2 164.90.225.61 port 49838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.194.5
country_id: 3508796
description:
Nov 25 03:56:38 host2 sshd[1910073]: Disconnected from invalid user admin 45.169.194.5 port 56514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 03:58:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<udiBr15EEL4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 03:58:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<4HzLr15EysEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 25 04:01:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<flymuF5EmItn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 04:04:05 host2 sshd[1919560]: Disconnected from invalid user user 2.57.121.25 port 32793 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-11-25 04:06:56 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:60517: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Nov 25 04:07:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.219, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c7g/zV5ER8jN0h/b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-25 04:07:05 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:57791: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-25 04:07:23 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:33772: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.81.154
country_id: 3865483
description:
Nov 25 04:07:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=45.230.81.154, lip=66.85.158.91, TLS, session=<uq73zV5EJY8t5lGa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.85.208.13
country_id: 798544
description:
Nov 25 04:07:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=45.85.208.13, lip=66.85.158.91, TLS, session=<WuxDz15E9NAtVdAN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 25 04:08:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<lmhi0l5Ewpw+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 25 04:08:53 host2 sshd[1925153]: Disconnected from invalid user redmine 193.106.245.20 port 60795 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 25 04:10:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<LMTq115EKJaLonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Nov 25 04:11:24 host2 sshd[1928126]: Disconnected from invalid user gitlab 193.106.245.20 port 60996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 25 04:11:28 host2 sshd[1928182]: Disconnected from invalid user openvpn 190.221.50.123 port 41292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.130.85.36
country_id: 1210997
description:
Nov 25 04:11:37 host2 sshd[1928352]: Disconnected from invalid user teste 114.130.85.36 port 44004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 25 04:12:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xC3e4V5EGogv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-11-25 04:13:30 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:35530: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 25 04:13:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2tO05F5EAwVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 25 04:13:03 host2 sshd[1929947]: Disconnected from invalid user weblogic 190.221.50.123 port 47974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 04:13:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vUnf415EEIsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 25 04:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<CHtk6V5ENuov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 04:14:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<hZV56V5Err92wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.130.85.36
country_id: 1210997
description:
Nov 25 04:14:36 host2 sshd[1931501]: Disconnected from invalid user public 114.130.85.36 port 56336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 25 04:14:38 host2 sshd[1931569]: Disconnected from invalid user test 190.221.50.123 port 60586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 25 04:16:11 host2 sshd[1933309]: Disconnected from invalid user ubuntu 190.221.50.123 port 45724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Nov 25 04:17:47 host2 sshd[1935196]: Disconnected from invalid user vss 190.221.50.123 port 42948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.130.85.36
country_id: 1210997
description:
Nov 25 04:17:29 host2 sshd[1934815]: Disconnected from invalid user admin 114.130.85.36 port 59670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.130.85.36
country_id: 1210997
description:
Nov 25 04:18:51 host2 sshd[1936607]: Disconnected from invalid user ansadmin 114.130.85.36 port 34198 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 25 04:19:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<GlSj+l5E4NQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 04:19:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<o3Fm+V5EQsgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 25 04:19:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<i1dS+l5EeM6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 25 04:20:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<YSZs/V5ESJiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 25 04:20:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Yd0I/F5E6oAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 25 04:20:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fmhG/V5EjIel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 25 04:23:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<oWv/Bl9Eiq3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 25 04:24:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<C5pdDV9EBsII04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 04:29:56 host2 sshd[1949167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.126
country_id: 1269750
description:
Nov 25 04:30:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=103.30.83.126, lip=66.85.158.91, TLS, session=<jHuiHl9ERphnHlN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.167
country_id: 798544
description:
Nov 25 04:30:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=78.31.145.167, lip=66.85.158.91, TLS, session=<gETlH19EiYhOH5Gn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 25 04:30:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<ZzgCIV9Ekq8+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 04:34:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wBkrMV9EXiovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 04:36:48 host2 sshd[1954714]: Disconnected from invalid user user 2.57.121.25 port 44665 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 04:40:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<m2HAQ19EWogv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 04:45:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<HaIPVl9Ebsh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 04:56:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Hjo1f19EspUvTJuG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Nov 25 04:58:13 host2 pure-ftpd[1969308]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 05:01:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<4il1jl9ElMkv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 05:03:52 host2 sshd[1973288]: Disconnected from invalid user admin 2.57.121.112 port 6479 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.198
country_id: 690791
description:
Nov 25 05:04:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.17.124.198, lip=66.85.158.91, TLS, session=<FhC1mF9Eq8q5EXzG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.105.214.48
country_id: 3865483
description:
Nov 25 05:04:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.105.214.48, lip=66.85.158.91, TLS, session=<IgzemV9EDdK+adYw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 05:10:09 host2 sshd[1978370]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-25 05:13:14 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:56425: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 05:15:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6en+wV9Expx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 05:18:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DHafzV9ESJIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.130.238.85
country_id: 1522867
description:
Nov 25 05:19:29 host2 sshd[1985979]: Disconnected from invalid user bitwarden 188.130.238.85 port 30196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.130.238.85
country_id: 1522867
description:
Nov 25 05:20:48 host2 sshd[1987085]: Disconnected from invalid user django 188.130.238.85 port 13082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 05:21:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<IiUQ2V9Ejugv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 05:22:45 host2 sshd[1988313]: Disconnected from invalid user test 2.57.121.112 port 61513 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.94.4.184
country_id: 298795
description:
Nov 25 05:24:46 host2 sshd[1989950]: Disconnected from invalid user backend 45.94.4.184 port 51776 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 05:25:10 host2 sshd[1990310]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.130.238.85
country_id: 1522867
description:
Nov 25 05:25:50 host2 sshd[1990726]: Disconnected from invalid user vncuser 188.130.238.85 port 49514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.184
country_id: 298795
description:
Nov 25 05:26:19 host2 sshd[1991018]: Disconnected from invalid user dangulo 45.94.4.184 port 45332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.211
country_id: 298795
description:
Nov 25 05:27:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=45.67.155.211, lip=66.85.158.91, TLS, session=<4CRJ6l9EeuYtQ5vT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.140.123
country_id: 690791
description:
Nov 25 05:27:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.140.123, lip=66.85.158.91, TLS, session=<mL1i619EuMgl3Yx7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.130.238.85
country_id: 1522867
description:
Nov 25 05:30:41 host2 sshd[1994443]: Disconnected from invalid user dangulo 188.130.238.85 port 52020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 05:40:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<c3nyG2BEFpYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 05:42:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Hb+MI2BEQMAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 05:44:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<VsRFK2BEAIB2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 05:46:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63797: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 25 05:47:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<hjHzNGBEzrGSOC+J>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Nov 25 05:48:16 host2 pure-ftpd[2005791]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.254.227.135
country_id: 6252001
description:
2025-11-25 05:50:37 dovecot_plain authenticator failed for hwsrv-1306184.hostwindsdns.com [23.254.227.135]:53067: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.118
country_id: 2963597
description:
Nov 25 05:54:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=37.203.49.118, lip=66.85.158.91, TLS, session=<yDirTWBEg5QlyzF2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Nov 25 05:55:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=</gjSTmBE7MaxV8mH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.117
country_id: 6252001
description:
Nov 25 06:01:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.117, lip=66.85.158.92, TLS: Connection closed, session=<ADFtZmBE2B3HLZp1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 06:02:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<JLFjamBEyggvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 06:03:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<nIBibmBEJOUv7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.59
country_id: 6252001
description:
Nov 25 06:06:35 host2 pure-ftpd[2019850]: (?@205.210.31.59) [INFO] New connection from 205.210.31.59


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 06:06:54 host2 sshd[2020032]: Disconnected from invalid user breonna 62.60.131.157 port 60564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 06:13:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<lTffkmBE1qJ2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 06:20:52 host2 sshd[2030775]: Disconnected from invalid user admin 2.57.121.112 port 39751 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 06:24:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aENOuGBEGlIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 06:24:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<sJmtuGBEOsQv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 06:26:03 host2 sshd[2035169]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.252.229.77
country_id: 3865483
description:
Nov 25 06:26:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@weeratrading.com>, method=PLAIN, rip=201.252.229.77, lip=66.85.158.91, TLS, session=<QMLnv2BEU5LJ/OVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.110
country_id: 798544
description:
Nov 25 06:27:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.238.166.110, lip=66.85.158.91, TLS, session=<uo1BwWBEvclb7qZu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 06:36:58 host2 sshd[2043690]: Disconnected from invalid user user 2.57.121.25 port 51774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 06:40:15 host2 sshd[2046178]: Disconnected from invalid user breonna 62.60.131.157 port 9188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 06:41:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Vdre9GBEisF2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.126
country_id: 6252001
description:
Nov 25 06:41:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.126, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<W+px9WBERMaTuYR+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.117
country_id: 6252001
description:
Nov 25 06:42:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.117, lip=66.85.158.91, session=<e85/92BE4PvG6xh1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 06:45:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<P9qzAmFE5q4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 06:46:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NVEyBmFEpukvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.130
country_id: 953987
description:
Nov 25 06:57:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.64.41.130, lip=66.85.158.91, TLS, session=<BI13LmFEg5RmQCmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.14
country_id: 798544
description:
Nov 25 06:58:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<training>, method=PLAIN, rip=91.231.121.14, lip=66.85.158.91, TLS, session=<T8vRL2FEpN9b53kO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 07:06:31 host2 sshd[2068013]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 07:05:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</7foTGFETrgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 07:08:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<7gdeVGFECJQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 07:09:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<L4VLWWFE1rR2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 25 07:10:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Ifg9XGFETM/PWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 25 07:10:09 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<ik02XGFEPs/PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.218.131
country_id: 798544
description:
Nov 25 07:17:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=109.125.218.131, lip=66.85.158.91, TLS, session=<QxGmdWFEXaxtfdqD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.146
country_id: 3175395
description:
Nov 25 07:17:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.239.35.146, lip=66.85.158.91, TLS, session=<2L3EdmFEMuKy7yOS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 25 07:19:27 host2 sshd[2078048]: Disconnected from invalid user supermaint 107.172.155.3 port 50868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Nov 25 07:19:33 host2 sshd[2078113]: Disconnected from invalid user gerrit 41.59.86.232 port 36440 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.28
country_id: 1605651
description:
Nov 25 07:20:30 host2 pure-ftpd[2079108]: (?@103.176.152.28) [INFO] New connection from 103.176.152.28


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 25 07:20:11 host2 sshd[2078707]: Disconnected from invalid user bob 103.144.146.186 port 44912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 25 07:20:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<5YaJgmFEzp4+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.49
country_id: 6252001
description:
Nov 25 07:21:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</tVXhGFEStLG6xgx>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.79.57.193
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 105.79.57.193 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.167.203.154
country_id: 3508796
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 190.167.203.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 105.79.57.193
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 105.79.57.193 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 25 07:25:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<lIZ6lGFEeqA+PIOJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 25 07:26:16 host2 sshd[2083686]: Disconnected from invalid user hamed 103.144.146.186 port 57429 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.79.57.193
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 105.79.57.193 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 25 07:25:45 host2 sshd[2083350]: Disconnected from invalid user testuser 107.172.155.3 port 35734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 25 07:27:00 host2 sshd[2084202]: Disconnected from invalid user qwerty 107.172.155.3 port 44448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 07:26:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<dwnylmFEfOcv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Nov 25 07:27:48 host2 sshd[2084930]: Disconnected from invalid user fan 41.59.86.232 port 43292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 25 07:28:13 host2 sshd[2085238]: Disconnected from invalid user roott 103.144.146.186 port 42660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 25 07:29:05 host2 sshd[2085853]: Disconnected from invalid user bob 107.172.155.3 port 33458 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 25 07:30:09 host2 sshd[2086856]: Disconnected from invalid user vps 107.172.155.3 port 54400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 07:29:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PtIEomFEdM0vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Nov 25 07:30:42 host2 sshd[2087415]: Disconnected from invalid user old 41.59.86.232 port 56242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.59.86.232
country_id: 149590
description:
Nov 25 07:32:11 host2 sshd[2088800]: Disconnected from invalid user bob 41.59.86.232 port 43378 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 25 07:32:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<yyO3q2FE3HynXpI7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 25 07:32:28 host2 sshd[2089002]: Disconnected from invalid user admin123 103.144.146.186 port 41363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-25 07:34:06 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:48245: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-25 07:34:29 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40678: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 07:37:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<NjUPvmFEJuc+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 07:37:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<KI2bvGFECLs+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 07:37:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<1Fphv2FE4pd2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:39:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<MuhZxGFEhLoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:39:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<f25gxmFEOsIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:41:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<z4opzWFEjrcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:42:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<NzGL0GFEvooDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:43:55 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<qzH41GFEiMwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:44:52 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<2hFV2GFEdIADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 07:47:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<tziW4WFESq0v7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:46:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QeSV3mFEos4DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:47:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<b+lG4mFExswDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:48:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<0k3/5mFE5tMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 25 07:49:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<4zI46mFE3NsDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-25 07:51:30 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:63708: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 07:51:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<t9hU8GFEOA4vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-25 07:51:44 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:37424: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 07:53:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<vDxO9mFEdJQ+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.152
country_id: 798544
description:
Nov 25 07:56:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.29.152, lip=66.85.158.91, TLS, session=<QiPp/2FEJLiy2B2Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.16
country_id: 953987
description:
Nov 25 07:55:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.45.16, lip=66.85.158.91, TLS, session=<yw+3/mFEXeBmQC0Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.10
country_id: 6252001
description:
Nov 25 07:59:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.10, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SrXYDGJEg5rDuEwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.239
country_id: 6252001
description:
Nov 25 07:59:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.239, lip=66.85.158.92, TLS: Connection closed, session=<Vt99DWJEncXDuEzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.238
country_id: 6252001
description:
Nov 25 07:59:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.238, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rBjhDWJEH7TDuEzu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.14
country_id: 6252001
description:
Nov 25 07:59:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.14, lip=66.85.158.92, TLS: Connection closed, session=<lQ8QDmJEV4XDuEwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 08:06:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<X5SeJGJEjsZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 08:08:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<iuFMLGJEjsUv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 08:10:46 host2 sshd[2117951]: Disconnected from invalid user admin 2.57.121.112 port 53140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 25 08:12:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<4EWIOmJEeN3PWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 25 08:12:19 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<CHeDOmJEbN3PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 25 08:12:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fpPDO2JEvM/PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 08:13:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<oypSP2JEtpMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 25 08:16:14 host2 sshd[2121374]: Disconnected from invalid user stperez 35.210.61.208 port 49058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 08:17:15 host2 sshd[2121919]: Disconnected from invalid user pritchard 2.57.121.112 port 61216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Nov 25 08:17:18 host2 sshd[2121988]: Disconnected from invalid user zjw 181.49.117.132 port 46880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 25 08:18:58 host2 sshd[2122953]: Disconnected from invalid user es 35.210.61.208 port 42034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 25 08:20:03 host2 sshd[2123856]: Disconnected from invalid user zjw 35.210.61.208 port 44500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 25 08:21:08 host2 sshd[2124614]: Disconnected from invalid user backend 35.210.61.208 port 46888 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.243.232.205
country_id: 6252001
description:
Nov 25 08:21:29 host2 pure-ftpd[2124975]: (?@162.243.232.205) [INFO] New connection from 162.243.232.205


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.55.51
country_id: 2264397
description:
Nov 25 08:20:38 host2 sshd[2124316]: Disconnected from invalid user taibabi 89.152.55.51 port 43642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Nov 25 08:20:56 host2 sshd[2124461]: Disconnected from invalid user testadmin 181.49.117.132 port 36350 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 08:22:23 host2 sshd[2125490]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 25 08:22:09 host2 sshd[2125354]: Disconnected from invalid user dixi 35.210.61.208 port 49290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Nov 25 08:23:25 host2 sshd[2126003]: Disconnected from invalid user backend 181.49.117.132 port 35486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.152.55.51
country_id: 2264397
description:
Nov 25 08:25:11 host2 sshd[2127379]: Disconnected from invalid user stperez 89.152.55.51 port 52872 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.243.232.205
country_id: 6252001
description:
Nov 25 08:24:54 host2 pure-ftpd[2127102]: (?@162.243.232.205) [INFO] New connection from 162.243.232.205


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Nov 25 08:25:54 host2 sshd[2127802]: Disconnected from invalid user shree 181.49.117.132 port 34618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 08:29:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kcFSd2JE6qMv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 08:32:43 host2 sshd[2131625]: Disconnected from invalid user ali 101.47.142.21 port 60726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.102.187
country_id: 1605651
description:
Nov 25 08:33:33 host2 sshd[2132089]: Disconnected from invalid user kiosk 49.229.102.187 port 33192 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.99
country_id: 3017382
description:
Nov 25 08:34:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.99, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7HETiGJEBYhbxJhj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 08:34:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Mt11iGJEgKp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.98
country_id: 3017382
description:
Nov 25 08:34:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.98, lip=66.85.158.92, TLS: Connection closed, session=<RlnLiWJEz7FbxJhi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.101
country_id: 3017382
description:
Nov 25 08:34:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=91.196.152.101, lip=66.85.158.92, TLS: Connection closed, session=<4zbyiGJEG8NbxJhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-25 08:34:18 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:41225: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.10
country_id: 3017382
description:
Nov 25 08:34:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.10, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3iWbiWJE1YBbxJgK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-11-25 08:34:36 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:53591: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Nov 25 08:34:45 host2 sshd[2133000]: Disconnected from invalid user sysop 68.183.224.170 port 58566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 08:35:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Bh/5jWJEJEUvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.102.187
country_id: 1605651
description:
Nov 25 08:35:50 host2 sshd[2134028]: Disconnected from invalid user sysadmin 49.229.102.187 port 49892 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Nov 25 08:36:07 host2 sshd[2134189]: Disconnected from invalid user user 68.183.224.170 port 50486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 25 08:36:44 host2 sshd[2134464]: Disconnected from invalid user scan 95.39.201.205 port 35850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.237
country_id: 3865483
description:
Nov 25 08:39:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 45 secs): user=<info@saara.lk>, method=PLAIN, rip=190.181.101.237, lip=66.85.158.91, TLS, session=<zU7kl2JEnLW+tWXt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.54.18.202
country_id: 2623032
description:
Nov 25 08:39:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=87.54.18.202, lip=66.85.158.91, TLS, session=<9qiqmmJEE5NXNhLK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.229.102.187
country_id: 1605651
description:
Nov 25 08:40:30 host2 sshd[2137033]: Disconnected from invalid user production 49.229.102.187 port 49964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 08:41:13 host2 sshd[2137447]: Disconnected from invalid user leann 62.60.131.157 port 42027 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Nov 25 08:41:23 host2 sshd[2137534]: Disconnected from invalid user autrede 103.172.205.103 port 45932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.229.102.187
country_id: 1605651
description:
Nov 25 08:42:10 host2 sshd[2137926]: Disconnected from invalid user super 49.229.102.187 port 53448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Nov 25 08:42:30 host2 sshd[2138101]: Disconnected from invalid user test3 68.183.224.170 port 52570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 08:43:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<fWGhqWJEtJA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.200
country_id: 3865483
description:
Nov 25 08:45:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.190.167.200, lip=66.85.158.91, TLS, session=<f3KjsGJEnuW6vqfI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.52.20
country_id: 2963597
description:
Nov 25 08:46:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.203.52.20, lip=66.85.158.91, TLS, session=<7Wd9smJEfqclyzQU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 08:46:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<yufGs2JEDsc+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 08:50:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<qLY4w2JESqMv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.103
country_id: 1643084
description:
Nov 25 08:51:22 host2 sshd[2145850]: Disconnected from invalid user bitnami 103.172.205.103 port 42232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 25 08:52:10 host2 sshd[2146337]: Disconnected from invalid user postgres 95.39.201.205 port 57112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Nov 25 08:53:24 host2 sshd[2147078]: Disconnected from invalid user production 103.172.205.103 port 55716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 25 08:55:38 host2 sshd[2149289]: Disconnected from invalid user debian 95.39.201.205 port 43442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 08:55:43 host2 sshd[2149343]: Disconnected from invalid user es 101.47.142.21 port 55670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-11-25 08:57:32 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:42484: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 08:58:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LDsb3mJEuJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-25 08:58:20 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:54396: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:02:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6vBR7WJEqol2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 09:05:56 host2 sshd[2155879]: Disconnected from invalid user stperez 101.47.142.21 port 40516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.30
country_id: 1880251
description:
Nov 25 09:08:22 host2 sshd[2157430]: Disconnected from invalid user dspace 45.78.230.30 port 33572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 09:11:04 host2 sshd[2159401]: Disconnected from invalid user abhi 101.47.142.21 port 33190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:12:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<S4TPD2NEIJ0v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 09:13:26 host2 sshd[2160834]: Disconnected from invalid user leann 62.60.131.157 port 25004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 09:19:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wn42KmNEJKM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 09:20:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wBZ9LmNETmovTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.123
country_id: 2264397
description:
Nov 25 09:22:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.123, lip=66.85.158.91, TLS, session=<+uA4N2NEHawtnIF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 09:23:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<pOlUOWNETJc+PIOI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.25
country_id: 1605651
description:
Nov 25 09:23:47 host2 pure-ftpd[2167266]: (?@103.176.152.25) [INFO] New connection from 103.176.152.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:30:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<h0hiUWNEKN12wSaf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Nov 25 09:30:08 host2 pure-ftpd[2171278]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 25 09:32:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<Omp6WGNE7q4s3lFz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<u10DXGNEHMYv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:34:27 host2 sshd[2174152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.183
country_id: 2300660
description:
Nov 25 09:34:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.139.11.183, lip=66.85.158.91, TLS, session=<UrP1YGNE/pgpiwu3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.252
country_id: 3469034
description:
Nov 25 09:35:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.251.252, lip=66.85.158.91, TLS, session=<+B5BYmNEupe60fv8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 09:41:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-25 09:41:30 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56529: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-25 09:41:49 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:53179: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 09:43:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<v+Zff2NEdMwvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:52:21 host2 sshd[2188108]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:54:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<11e+qGNExtYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.134
country_id: 953987
description:
Nov 25 09:57:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.43.134, lip=66.85.158.91, TLS, session=<fBrhsGNEBeFmQCuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:57:33 host2 sshd[2192942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.61
country_id: 3469034
description:
Nov 25 09:57:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.11.251.61, lip=66.85.158.91, TLS, session=<RDorsmNEGuexC/s9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:58:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<PRdqtmNENLV2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 25 10:03:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<Ico3yWNEEOQDWgzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:05:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<n06+0GNE9AwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 10:07:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<bt4d12NE+LU+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.122.95.15
country_id: 6252001
description:
2025-11-25 10:08:23 dovecot_plain authenticator failed for 15.95.122.34.bc.googleusercontent.com (bcone-vais-sharepoint-2-nov.bcone-vais2-shar.com) [34.122.95.15]:51053: 535 Incorrect authentication data (set_id=googlecloud)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.122.95.15
country_id: 6252001
description:
2025-11-25 10:08:32 dovecot_login authenticator failed for 15.95.122.34.bc.googleusercontent.com (bcone-vais-sharepoint-2-nov.bcone-vais2-shar.com) [34.122.95.15]:51053: 535 Incorrect authentication data (set_id=googlecloud)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 10:08:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<SjKR2mNEgMw+PIOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.158.166
country_id: 6252001
description:
Nov 25 10:11:28 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, session=<Jy+n5GNE3N5HBp6m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 10:11:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<5/AI5GNEiNo+PIOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:12:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5dK06WNEDt+TuYSD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 10:13:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<5HCc6mNE8Jw+PIOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:13:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<ZY4m7WNEZuiTuYSD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:16:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RVcs9WNEptCi2JUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:16:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<SGzR9WNEgKcv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 10:15:33 host2 sshd[2206659]: Disconnected from invalid user admin 2.57.121.112 port 53368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:17:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<I23d+GNEvPGi2JUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:20:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS, session=<YF/NA2REVvSTuYSD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-25 10:21:21 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:38856: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 25 10:22:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<gqWbC2REBo42xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:24:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS, session=<BeiMEmREQPei2JUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 10:27:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<exrwHWRE2t52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 10:27:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<pkEWHmREHqM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:28:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BXV6ImREFtsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.242
country_id: 3469034
description:
Nov 25 10:30:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=187.120.76.242, lip=66.85.158.91, TLS, session=<1AhDKGREFrW7eEzy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.169
country_id: 798544
description:
Nov 25 10:30:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.238.166.169, lip=66.85.158.91, TLS, session=<5vtpKWRE2NRb7qap>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 10:33:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<krVxM2RErJU+PIOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov 25 10:38:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, session=<pSwPRWREouDG6xj4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:37:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<QYJBQ2RE5NIv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-25 10:49:27 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:45648: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 10:48:55 host2 sshd[2229513]: Disconnected from invalid user admin 2.57.121.112 port 23775 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:51:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<N2lZcmREfOgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.18
country_id: 3865483
description:
Nov 25 10:53:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.87.18, lip=66.85.158.91, TLS, session=<0rXxeGREJ52+tVcS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.92
country_id: 3865483
description:
Nov 25 10:52:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=190.181.87.92, lip=66.85.158.91, TLS, session=<uW62d2RE/um+tVdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 10:57:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<KisQiGRE7pR2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 10:58:17 host2 sshd[2236167]: Disconnected from invalid user grid 64.188.75.249 port 42520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:59:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<78FXkGREmL4v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:01:54 host2 sshd[2238405]: Disconnected from invalid user admin 107.189.29.175 port 46678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 25 11:03:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<OYpfnWREesCSOC+J>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.143.58.151
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.143.58.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:03:30 host2 sshd[2239598]: Disconnected from invalid user ahmed 190.111.211.81 port 39104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:04:26 host2 sshd[2240145]: Disconnected from invalid user amssys 64.188.75.249 port 58062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:06:22 host2 sshd[2241864]: Disconnected from invalid user admin 64.188.75.249 port 43606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:06:29 host2 sshd[2241943]: Disconnected from invalid user sonarqube 190.111.211.81 port 46716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:05:52 host2 sshd[2241292]: Disconnected from invalid user grid 107.189.29.175 port 54466 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:07:02 host2 sshd[2242296]: Disconnected from invalid user gerrit 107.189.29.175 port 55268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 25 11:07:22 host2 sshd[2242581]: Disconnected from invalid user mcserver 152.32.185.214 port 56622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.91
country_id: 6252001
description:
2025-11-25 11:07:27 dovecot_login authenticator failed for ([70.174.168.91]) [70.174.168.91]:59092: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:07:53 host2 sshd[2242828]: Disconnected from invalid user amssys 190.111.211.81 port 36550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:08:18 host2 sshd[2243115]: Disconnected from invalid user ahmed 64.188.75.249 port 39660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.38
country_id: 1168579
description:
Nov 25 11:07:39 host2 sshd[2242724]: Disconnected from invalid user asterisk 58.27.134.38 port 16782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-25 11:07:44 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:44117: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:08:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ZyZDsWREBLwDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 11:09:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<Epuas2RE1N0+PIOK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.38
country_id: 1168579
description:
Nov 25 11:10:21 host2 sshd[2244508]: Disconnected from invalid user admin 58.27.134.38 port 49186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 25 11:09:52 host2 sshd[2244016]: Disconnected from invalid user retag 152.32.185.214 port 53148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:10:40 host2 sshd[2244657]: Disconnected from invalid user david 190.111.211.81 port 40598 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:11:49 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<cqV1vGREjJgDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 11:12:15 host2 sshd[2245664]: Disconnected from invalid user yessenia 62.60.131.157 port 28136 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:12:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<y3gsv2REmMcDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:12:35 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gC80v2REtMcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:13:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<UcotwWREIJIvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:13:40 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<zFkaw2REIpQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-25 11:18:00 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:58086: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-25 11:18:14 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:40854: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 11:21:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<bJmw3WREiqsv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:27:00 host2 sshd[2254844]: Disconnected from invalid user zabbix 101.47.142.104 port 34164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 11:27:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wijh9GREBMd2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:28:47 host2 sshd[2255789]: Disconnected from invalid user teste 202.157.176.165 port 54124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:30:02 host2 sshd[2256531]: Disconnected from invalid user ftpuser 188.166.248.139 port 57708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:30:09 host2 sshd[2256710]: Disconnected from invalid user gitlab-runner 202.157.176.165 port 53036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:32:37 host2 sshd[2258189]: Disconnected from invalid user mqm 188.166.248.139 port 45712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:32:39 host2 sshd[2258201]: Disconnected from invalid user admin 202.157.176.165 port 34938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1m+3EGVEmiovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:35:09 host2 sshd[2259888]: Disconnected from invalid user gg 188.166.248.139 port 43176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:36:15 host2 sshd[2260501]: Disconnected from invalid user ansible 101.47.142.104 port 40790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:36:30 host2 sshd[2260610]: Disconnected from invalid user git 202.157.176.165 port 48004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.230.11.165
country_id: 2661886
description:
Nov 25 11:38:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=81.230.11.165, lip=66.85.158.91, TLS, session=<2iGZGmVExNhR5gul>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.160
country_id: 130758
description:
Nov 25 11:39:22 host2 pure-ftpd[2262454]: (?@91.231.222.160) [INFO] New connection from 91.231.222.160


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.224
country_id: 2510769
description:
Nov 25 11:38:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.74.240.224, lip=66.85.158.91, TLS, session=<EV2sG2VEvLe5SvDg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.100.114
country_id: 1819730
description:
Nov 25 11:39:14 host2 pure-ftpd[2262367]: (?@196.251.100.114) [INFO] New connection from 196.251.100.114


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 11:42:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<V1HKK2VE6Kov7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 11:44:23 host2 sshd[2265524]: Disconnected from invalid user  2.57.121.112 port 61177 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:48:05 host2 sshd[2268634]: Disconnected from invalid user tony 52.169.142.214 port 43736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:49:14 host2 sshd[2269620]: Disconnected from invalid user casaos 52.169.142.214 port 54344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:50:26 host2 sshd[2270694]: Disconnected from invalid user user 52.169.142.214 port 34412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-25 11:50:30 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:51331: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-25 11:50:43 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:50142: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 11:54:25 host2 sshd[2273867]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:54:19 host2 sshd[2273694]: Disconnected from invalid user zimbra 52.169.142.214 port 33808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 25 11:55:35 host2 sshd[2275237]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 60204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:56:58 host2 sshd[2276262]: Disconnected from invalid user toto 101.47.142.104 port 32924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:57:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<d/ZxYWVEdEkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 11:58:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<DGedYmVEbKl2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:59:29 host2 sshd[2278358]: Disconnected from invalid user ftpuser 101.47.142.104 port 44798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:05:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</KaDemVEbMYv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 12:06:21 host2 sshd[2284742]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Nov 25 12:08:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.172, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kZHniGVEJtPG6xis>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:09:31 host2 sshd[2287217]: Disconnected from invalid user sonarqube 103.106.194.74 port 43666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 25 12:11:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<FeaRkGVEAroDU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:13:51 host2 sshd[2291505]: Disconnected from invalid user ansible 103.106.194.74 port 49296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:15:12 host2 sshd[2292972]: Disconnected from invalid user arkserver 103.106.194.74 port 51156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.8.179
country_id: 3077311
description:
Nov 25 12:15:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=31.222.8.179, lip=66.85.158.91, TLS, session=<AT+eoGVEk9Af3giz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.1.252.234
country_id: 798544
description:
Nov 25 12:16:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.1.252.234, lip=66.85.158.91, TLS, session=<LW2noWVEns3CAfzq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 12:20:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<UcM7smVE4I0vTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 25 12:23:33 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<sH8AvWVEfIksyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:27:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<4kSlyWVE0NUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 12:28:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A1HozmVENMt2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-25 12:34:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-25 12:33:58 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:33494: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-11-25 12:41:53 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:40974: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.11.128
country_id: 6252001
description:
2025-11-25 12:42:19 dovecot_login authenticator failed for 160-3-11-128.cpe.sparklight.net [160.3.11.128]:42808: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-25 12:42:32 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:41684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 12:43:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<eWcSBGZE7kAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:49:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kdDrGWZE0qMv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 12:52:32 host2 sshd[2317964]: Disconnected from invalid user admin 2.57.121.112 port 59809 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 25 12:54:41 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<t/ZWLGZEIKgDWgzA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 12:58:31 host2 sshd[2321971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 12:59:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<87eFPGZE7LB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 13:06:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<H7GlVmZEeD8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 13:08:03 host2 sshd[2328011]: Disconnected from invalid user user 2.57.121.25 port 47948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 13:12:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<dSriamZEdsQv7bxd>


