# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 06:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<8TdQDhBEDJaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 06:10:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lBsfEBBERMyLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-21 06:11:02 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:47898: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-11-21 06:11:26 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:42038: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 21 06:15:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<2WC1HxBEC6LOvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 21 06:15:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6htxIBBEATPOvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.242
country_id: 2921044
description:
Nov 21 06:15:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.172.179.242, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kLDOIRBE2FGnrLPy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 06:16:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<BxC5IxBEOsUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 06:16:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<+PUDJRBEEOGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 06:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<G6ufKBBE0LgtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.255
country_id: 3175395
description:
Nov 21 06:17:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=171.22.233.255, lip=66.85.158.91, TLS, session=<OFLeJxBEiIWrFun/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 06:17:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ocXsKRBEAJwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.246
country_id: 226074
description:
Nov 21 06:17:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.107.246, lip=66.85.158.91, TLS, session=<ITIRKRBEMdHEAGv2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 06:23:04 host2 sshd[2022908]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 06:23:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vc7ZPRBEvrIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 06:25:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<D6/AQxBEGp4vWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 06:25:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PjSHRhBE6IcI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 06:25:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63850: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 06:26:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<8XjRRxBEOrov+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 06:26:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<BTFJSRBE2OaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 06:28:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<02//TRBETJozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 06:28:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ekMHURBEwJhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 06:31:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<EVeJWxBE8LotPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.191.236.201
country_id: 3469034
description:
Nov 21 06:32:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.191.236.201, lip=66.85.158.91, TLS, session=<ZBCwXhBEkcstv+zJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 06:33:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<3Z74XxBEBsSl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.192.195.122
country_id: 6252001
description:
2025-11-21 06:33:07 dovecot_login authenticator failed for ([72.192.195.122]) [72.192.195.122]:60226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Nov 21 06:33:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, TLS, session=<J/xGYBBE6OXN0h9s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.3.225
country_id: 1880251
description:
Nov 21 06:32:21 host2 sshd[2029015]: Disconnected from invalid user sagar 47.237.3.225 port 58546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 06:32:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QR/fXhBE8JNnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.42
country_id: 298795
description:
Nov 21 06:33:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<K/fSXxBEYb5fAKsq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-21 06:33:24 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:63844: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:35:45 host2 sshd[2031224]: Disconnected from invalid user ubuntu 107.175.228.153 port 58140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 06:36:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eV4kbBBEqIov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:38:46 host2 sshd[2033022]: Disconnected from invalid user user1 37.255.249.201 port 44880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 06:39:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<hY6ReBBEKIKElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:39:55 host2 sshd[2033752]: Disconnected from invalid user blog 107.175.228.153 port 42786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 06:40:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<YKUkfBBEVJtK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:41:02 host2 sshd[2034631]: Disconnected from invalid user sagar 107.175.228.153 port 37418 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.8
country_id: 6252001
description:
Nov 21 06:41:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O3DJfBBEm51b5qgI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 06:40:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9QOGeRBEJsZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 06:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6ez/fxBE1OtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 06:41:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<IN1QfRBEmNeYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.9
country_id: 6252001
description:
Nov 21 06:41:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.9, lip=66.85.158.91, TLS: Connection closed, session=<NTZxfRBEfaBb5qgJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Nov 21 06:41:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.1, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wEX7fRBEl8Vb5qgB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.12
country_id: 6252001
description:
Nov 21 06:41:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.12, lip=66.85.158.91, TLS: Connection closed, session=<W8YpfhBEfeVb5qgM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 06:42:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Z/6LgxBE4pMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:44:52 host2 sshd[2036935]: Disconnected from invalid user nexus 37.255.249.201 port 44114 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 21 06:45:46 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS, session=<+XWbjRBEwc9X7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.24
country_id: 2635167
description:
Nov 21 06:45:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4++rjRBEYZlX7LAY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:46:44 host2 sshd[2038631]: Disconnected from invalid user david 87.201.127.149 port 35164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.18
country_id: 2635167
description:
Nov 21 06:46:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.18, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<CWiojxBEpdS594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.13
country_id: 2635167
description:
Nov 21 06:46:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1uOmkRBEc8y594kN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.31
country_id: 1643084
description:
Nov 21 06:46:55 host2 sshd[2038712]: Disconnected from invalid user ubuntu 103.179.57.31 port 52658 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.10
country_id: 2635167
description:
Nov 21 06:47:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.10, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<egGjkxBEdcm594kK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:47:34 host2 sshd[2039091]: Disconnected from invalid user dev 154.83.15.92 port 52746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Nov 21 06:48:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<pBiglRBE26y594kQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:48:07 host2 sshd[2039363]: Disconnected from invalid user andrew 41.111.162.34 port 6548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.10
country_id: 2635167
description:
Nov 21 06:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.10, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Nx2amRBEbby594kK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.27
country_id: 2635167
description:
Nov 21 06:48:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.27, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cEGalxBEZ+u594kb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:48:58 host2 sshd[2039749]: Disconnected from invalid user boot 154.83.15.92 port 52678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:49:23 host2 sshd[2039997]: Disconnected from invalid user ubuntu 87.201.127.149 port 47784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.7
country_id: 2635167
description:
Nov 21 06:49:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.7, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RgqXmxBEwbW594kH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 06:49:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<lkSUmxBELEgtTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:49:51 host2 sshd[2040094]: Disconnected from invalid user pt 37.255.249.201 port 57812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:50:03 host2 sshd[2040359]: Disconnected from invalid user hsadmin 57.129.74.123 port 38444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:50:34 host2 sshd[2040712]: Disconnected from invalid user test1 41.111.162.34 port 28444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Nov 21 06:50:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<NnCOnxBEudJX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Nov 21 06:50:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<xGKRnRBEj9y594kQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:50:23 host2 sshd[2040638]: Disconnected from invalid user ubuntu 154.83.15.92 port 52628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:51:18 host2 sshd[2041051]: Disconnected from invalid user ray 5.182.83.231 port 57572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:51:30 host2 sshd[2041151]: Disconnected from invalid user syp 37.255.249.201 port 51264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:51:46 host2 sshd[2041254]: Disconnected from invalid user cod2server 156.238.252.133 port 33656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:53:03 host2 sshd[2041857]: Disconnected from invalid user newuser 37.255.249.201 port 48786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:53:05 host2 sshd[2041886]: Disconnected from invalid user mihail 41.111.162.34 port 4982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:52:29 host2 sshd[2041590]: Disconnected from invalid user boot 87.201.127.149 port 55490 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 06:53:23 host2 sshd[2042079]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.31
country_id: 1643084
description:
Nov 21 06:53:25 host2 sshd[2042121]: Disconnected from invalid user sinusbot 103.179.57.31 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:53:33 host2 sshd[2042257]: Disconnected from invalid user metabase 5.182.83.231 port 36752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:53:57 host2 sshd[2042389]: Disconnected from invalid user rise 156.238.252.133 port 57480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 06:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EaXEqBBERNeKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 06:54:18 host2 sshd[2042778]: Disconnected from invalid user andrew 157.245.49.180 port 44334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:54:31 host2 sshd[2043322]: Disconnected from invalid user pc 41.111.162.34 port 51290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:55:03 host2 sshd[2043686]: Disconnected from invalid user john 156.238.252.133 port 41178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:55:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Ev9tsBBEQIcDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:56:29 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<f5P1sxBE4oIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:57:14 host2 sshd[2044920]: Disconnected from invalid user ipfs 57.129.74.123 port 9308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:58:01 host2 sshd[2045309]: Disconnected from invalid user support 5.182.83.231 port 43426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:58:15 host2 sshd[2045486]: Disconnected from invalid user elastic 57.129.74.123 port 37438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:59:54 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<ZzgxwBBE4LcDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 06:59:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<bfwnwBBE8KiLO0qU>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:00:35 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<om2bwhBE2okDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 07:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<gt4JxBBE5L2kXF7M>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.13
country_id: 1605651
description:
Nov 21 07:01:06 host2 pure-ftpd[2047116]: (?@103.176.152.13) [INFO] New connection from 103.176.152.13


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:00:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<MKR0wRBEXkwtTeM5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:00:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<gZNZwhBEOIIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:02:03 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<YQLixxBEJK4Dg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:01:43 host2 sshd[2047399]: Disconnected from invalid user test-user 157.245.49.180 port 33916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 07:03:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<QsniyxBEbr6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:05:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<4vt71RBEQqUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:07:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<UbGQ2xBEopQrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-21 07:10:35 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:38478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-21 07:10:51 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:33779: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-21 07:10:58 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:33649: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-11-21 07:11:22 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [102.132.29.166]:56500: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.42
country_id: 6252001
description:
Nov 21 07:11:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.42, lip=66.85.158.92, TLS, session=<0sNt6RBEEvLG6xgq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-21 07:11:42 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:51582: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 07:11:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<nhGB6hBEaLsI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-21 07:11:55 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:49310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 07:11:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<NYuR6BBErNCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 07:11:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<yRPo6BBEqogrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 07:12:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<BogJ7RBECMcvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 07:13:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<07wt8BBEmscv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 07:14:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Poi39RBEhJozTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:15:04 host2 sshd[2055223]: Disconnected from invalid user test001 157.245.49.180 port 38700 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.112
country_id: 6252001
description:
Nov 21 07:16:27 host2 pure-ftpd[2056076]: (?@20.65.194.112) [INFO] New connection from 20.65.194.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 07:16:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<9cF2/BBEoI4tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 07:17:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<niRR/hBE3uhm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:18:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<QqQkBBFEctgDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 07:19:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Kw8mBhFEfIwv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:20:36 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<MScxChFEXLsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 07:20:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4JTAChFErI5noNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:22:23 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<zTeaEBFEqsEDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:22:37 host2 sshd[2059389]: Disconnected from invalid user leonardo 157.245.49.180 port 49434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:23:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<MVFLFRFE0twDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 07:23:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<z1pbFRFElNCElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:24:28 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<zxMLGBFEPtQDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:24:58 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<ETDSGRFEZpIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:25:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<pVHOGxFEVrsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 07:26:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WWBwHRFERJEv/AU1>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:26:47 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eh9KIBFENuMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.33
country_id: 6252001
description:
Nov 21 07:26:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.33, lip=66.85.158.91, TLS, session=<HPWfIBFEIuvN0h8h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 07:26:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<Jm2lIBFEvKql0iHB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:27:16 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<N9MOIhFE4ukDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 07:27:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<NkttIhFELqqYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 21 07:28:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<uPeaJxFEThNBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:28:55 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eSv1JxFEwKIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 21 07:29:15 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<oCMjKRFE4CNBMQGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 07:29:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<D6CkKRFEsKJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 07:29:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<RkxmKhFEsMxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 07:29:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ZXiCKxFEcuNnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 21 07:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.227.134.101, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bQulMBFEvpel44Zl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:31:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<w3XQMhFEhpctTeM5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:33:41 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.20, lip=66.85.158.91, session=<ZBP4OBFExKalmncU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:34:53 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.20, lip=66.85.158.92, session=<inRIPRFEbNWlmncU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.220
country_id: 1269750
description:
Nov 21 07:35:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=45.118.34.220, lip=66.85.158.91, TLS, session=<Ra3iPBFEY9MtdiLc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:35:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=165.154.119.20, lip=66.85.158.92, session=<UNhkPhFEdtWlmncU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.243
country_id: 3469034
description:
Nov 21 07:35:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.199.243, lip=66.85.158.91, TLS, session=<6o0jPhFEjuazvcfz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 07:36:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<T0ibQxFEjKmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.128
country_id: 3469034
description:
Nov 21 07:36:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.247.128, lip=66.85.158.91, TLS, session=<QxGqQhFEQOy60feA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.211
country_id: 1269750
description:
Nov 21 07:37:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=103.59.135.211, lip=66.85.158.91, TLS, session=<3n/9QxFE1MhnO4fT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:42:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<dAmyWBFEHqQtTeM5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.74
country_id: 2635167
description:
Nov 21 07:43:30 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.74, lip=66.85.158.91, TLS, session=<wF4WXBFESdq594lK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 07:45:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<HgUWZBFEfqikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 07:47:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ik2dahFE3I6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-21 07:53:13 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:51389: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-21 07:53:29 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58387: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Nov 21 07:53:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.26, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<nrHJgBFEZvei2JYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:55:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<uBtihhFEdrUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 07:56:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<yZ9+iRFEXMeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:57:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<f1yVjBFEqrkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 07:57:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<849ijxFEcoEI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 21 07:58:34 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.208.45, lip=66.85.158.92, TLS, session=<zhP3kRFEKoWUcdAt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Nov 21 07:58:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.26, lip=66.85.158.91, TLS, session=<fmx/khFEavGi2JYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 07:58:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<SiuOkhFEtMsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 07:59:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<N/1MlBFEsoEvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 08:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<VlrQmBFEquAv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 08:01:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<COzJnBFEwJozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:02:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pKqXoBFEGskv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 08:02:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<vDrknhFEXL4tPZWl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 08:03:13 host2 sshd[2082024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.234.180.75
country_id: 3865483
description:
Nov 21 08:04:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 31 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.234.180.75, lip=66.85.158.91, TLS, session=<0eKyoxFEF+st6rRL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.96
country_id: 1269750
description:
Nov 21 08:04:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.18.166.96, lip=66.85.158.91, TLS, session=<4lahpRFEIpJnEqZg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 08:05:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<paB3qxFExqJm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 08:07:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<U/F3sBFE1KWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:08:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vvojthFECM9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:09:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OeUAuBFEfsIv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.216
country_id: 6252001
description:
Nov 21 08:12:01 host2 pure-ftpd[2088073]: (?@205.210.31.216) [INFO] New connection from 205.210.31.216


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 08:14:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<6eAUyRFEoH2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:14:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<OeapyRFEOj8tTeM5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 08:17:47 host2 sshd[2093592]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<L2lq1xFEYM9noNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-21 08:18:05 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:60501: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-21 08:18:21 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:40234: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:18:21 host2 sshd[2094248]: Disconnected from invalid user michelle 83.168.78.153 port 35416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 08:18:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<RHgv2RFE0rVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 08:20:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<CH0c3xFEguqKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 08:19:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<3xDm2xFEGrdn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:19:47 host2 sshd[2095754]: Disconnected from invalid user web 82.24.64.116 port 33496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 08:20:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<bfH73hFExoql0iHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:22:59 host2 sshd[2098076]: Disconnected from invalid user rahim 139.59.231.45 port 52054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:23:05 host2 sshd[2098169]: Disconnected from invalid user julio 82.24.64.116 port 43826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:24:04 host2 sshd[2098710]: Disconnected from invalid user user123 83.168.78.153 port 51054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.238
country_id: 2328926
description:
2025-11-21 08:24:26 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:1473: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:24:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<flyD7xFE9DItTeM5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-21 08:24:54 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:53180: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:25:47 host2 sshd[2099923]: Disconnected from invalid user mqm 139.59.231.45 port 59162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:26:14 host2 sshd[2100123]: Disconnected from invalid user administrator 83.168.78.153 port 59044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:26:14 host2 sshd[2100126]: Disconnected from invalid user boss 82.24.64.116 port 36686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:27:09 host2 sshd[2100657]: Disconnected from invalid user comercial 139.59.231.45 port 37488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:28:17 host2 sshd[2101474]: Disconnected from invalid user comercial 83.168.78.153 port 43378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:29:12 host2 sshd[2102160]: Disconnected from invalid user administrator 82.24.64.116 port 55450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 08:30:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<E1jOBRJE+JOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.242.78.9
country_id: 3469034
description:
Nov 21 08:31:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=191.242.78.9, lip=66.85.158.91, TLS, session=<vFVvBhJEmIa/8k4J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.117
country_id: 3865483
description:
Nov 21 08:31:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.117.16.117, lip=66.85.158.91, TLS, session=<EszKBxJEfOeKdRB1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.74
country_id: 3469034
description:
Nov 21 08:33:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.39.32.74, lip=66.85.158.91, TLS, session=<YBQwDBJEYqaxJyBK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.113.110
country_id: 226074
description:
Nov 21 08:33:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=196.0.113.110, lip=66.85.158.91, TLS, session=<q6RkDRJERePEAHFu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 08:33:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<jjRNDxJEOoaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 08:35:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<nja2FBJEQLGLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 08:41:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KJRhKxJEns+YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 08:42:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<x89tMBJElqqSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 08:43:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SoRKNBJECIcXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 08:44:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VSJYNRJE2rUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 08:45:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<BT48OBJEyMErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:45:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<A2JsOxJEkpQv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:46:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<TxsVPBJEFL4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:46:15 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<za6APBJEPL4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 08:46:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<G9ZQPBJE6J8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 08:46:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<yyyKPBJEpKovWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 08:46:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<0ptwPhJE5JkrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:47:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XJvQQBJEyIcDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 08:47:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<rvaOQRJEEosv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 08:47:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<ZayvQRJEaM4tPZWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:48:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MDN4QxJEioADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 08:48:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<jv75QxJE7pozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 08:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<OX21SxJExOuElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:52:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<y4zzUhJEUJ4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 08:53:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<7yP+VhJEyudm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:54:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<ERIxWRJEyJgDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:56:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<uP8SYRJEjG0tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:56:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ama/YhJEAOZnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Nov 21 08:59:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.91, TLS handshaking: Connection closed, session=<u0FUbRJEZYpbxJi/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.188
country_id: 3017382
description:
Nov 21 09:00:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.188, lip=66.85.158.91, TLS: Connection closed, session=<K770bRJE57pbxJi8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.223
country_id: 3017382
description:
Nov 21 09:00:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.223, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Vuu7bhJER8BbxJjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.128
country_id: 798544
description:
Nov 21 09:00:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.219.102.128, lip=66.85.158.91, TLS, session=<fAj4bRJEbbOy22aA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 09:00:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<44ZNbxJE4FKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.198
country_id: 2510769
description:
Nov 21 09:00:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=139.28.190.198, lip=66.85.158.91, TLS, session=<XA2jbxJEp9GLHL7G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 09:04:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9pjdexJEir+KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:06:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vIJDhBJETLFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:07:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<66dRhxJEFLAtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 09:07:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<zgdAiRJEwulK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 09:09:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qCApjhJENNhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-21 09:11:27 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:39308: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-21 09:11:43 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:47188: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 09:16:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<LJS6qBJEXp+kXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 21 09:20:45 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<3rjntxJEwq7CpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 09:22:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<rer0vhJE5p2LO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.145.247
country_id: 6252001
description:
Nov 21 09:24:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.145.247, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3YfAxhJEnugUQZH3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.111.36
country_id: 2921044
description:
Nov 21 09:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.111.36, lip=66.85.158.91, session=<gZN3yRJE+yFA4m8k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.242
country_id: 2921044
description:
Nov 21 09:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.179.242, lip=66.85.158.91, session=<xA19yRJEWjSnrLPy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.224.63
country_id: 6252001
description:
Nov 21 09:25:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.127.224.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9YoByhJEOsMUf+A/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 09:26:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<QxwMzhJEbOGYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.28.112
country_id: 3469034
description:
Nov 21 09:27:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.152.28.112, lip=66.85.158.91, TLS, session=<cZKi0BJEjemxmBxw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.124
country_id: 798544
description:
Nov 21 09:28:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.108.124, lip=66.85.158.91, TLS, session=<vhXC0RJEEapVymx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 21 09:28:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.68.104.64, lip=66.85.158.91, TLS, session=<lkTO0hJE2pmKRGhA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 09:29:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<mQ3S1hJENKcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.109.66
country_id: 3469034
description:
Nov 21 09:29:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.85.109.66, lip=66.85.158.91, TLS, session=<iBEE1xJEe+e7VW1C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.110
country_id: 3469034
description:
Nov 21 09:30:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=191.37.11.110, lip=66.85.158.91, TLS, session=<hmlJ2BJEha6/JQtu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 09:30:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<4vug2xJEuOoI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 09:33:35 host2 sshd[2146199]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 09:33:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<M/IS5hJEUtQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 09:34:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vbZq5xJEpOMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 09:33:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<YoeA5RJEltMvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 09:34:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<6sdy5xJEmM6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 09:35:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<y5FX6xJECJszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 09:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<ifTo6xJEdqcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.102
country_id: 2921044
description:
2025-11-21 09:35:24 dovecot_login authenticator failed for (60hvPEBnK) [213.209.157.102]:59317: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 09:35:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<lW8x7BJEhM4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 09:35:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<wkzT7RJEYtwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.102
country_id: 2921044
description:
2025-11-21 09:36:10 dovecot_login authenticator failed for (brZvNrg9) [213.209.157.102]:51579: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 09:37:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<4fRw8hJEDqArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:39:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<jV/k+RJEQkItTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 09:41:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<k7j+ARNEGNhm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:43:42 host2 sshd[2152359]: Disconnected from invalid user test 118.194.231.208 port 33292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 09:44:57 host2 sshd[2153148]: Disconnected from invalid user destin 62.60.131.157 port 14513 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:45:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<OGOyEBNENOJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 09:46:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qfFbFRNEajuYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:47:22 host2 sshd[2155021]: Disconnected from invalid user user04 118.194.231.208 port 33516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 09:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gzkfGRNEQKGKxX03>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.105.81
country_id: 6252001
description:
Nov 21 09:49:06 host2 pure-ftpd[2156057]: (?@20.169.105.81) [INFO] New connection from 20.169.105.81


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:48:44 host2 sshd[2155703]: Disconnected from invalid user test 118.194.231.208 port 33616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:50:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<TZlmIBNEAsItTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:49:23 host2 sshd[2156176]: Disconnected from invalid user wedding 118.194.231.208 port 33666 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 09:53:37 host2 sshd[2159117]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:54:41 host2 sshd[2160508]: Disconnected from invalid user neolinux 154.31.231.194 port 51326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:55:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<HZJOMhNEIONnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.107
country_id: 1819730
description:
Nov 21 09:55:41 host2 sshd[2161660]: Disconnected from invalid user sales 103.103.245.107 port 44960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:55:46 host2 sshd[2161705]: Disconnected from invalid user user2 107.150.20.228 port 40272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Nov 21 09:55:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FKHlNRNEi9zG6xhn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:56:09 host2 sshd[2162000]: Disconnected from invalid user oracle 156.232.88.219 port 58552 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.176.42.158
country_id: 798544
description:
Nov 21 09:56:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=193.176.42.158, lip=66.85.158.91, TLS, session=<LmD/NxNEROXBsCqe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:56:59 host2 sshd[2162586]: Disconnected from invalid user roo 107.150.20.228 port 40396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.50
country_id: 953987
description:
Nov 21 09:57:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.50, lip=66.85.158.91, TLS, session=<ZIQhORNE0+NmQCsy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:57:19 host2 sshd[2162867]: Disconnected from invalid user ftpadmin1 156.232.88.219 port 58638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 09:57:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<SxT6OhNEYJhK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:58:23 host2 sshd[2163591]: Disconnected from invalid user user2 154.31.231.194 port 59062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 09:58:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1WnXPxNEKqhn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:58:06 host2 sshd[2163412]: Disconnected from invalid user ftpuser 107.150.20.228 port 40514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:59:45 host2 sshd[2164608]: Disconnected from invalid user ubuntu 154.31.231.194 port 52346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:59:46 host2 sshd[2164622]: Disconnected from invalid user marvin 156.232.88.219 port 58822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 10:01:03 host2 sshd[2165695]: Disconnected from invalid user admin1 156.232.88.219 port 58912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 10:00:15 host2 sshd[2165241]: Disconnected from invalid user rdp 107.150.20.228 port 40750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 10:01:09 host2 sshd[2165758]: Disconnected from invalid user roo 154.31.231.194 port 41734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 10:02:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<TST2TBNEGr+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 10:06:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<EDbAWhNEisul0iHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.107
country_id: 1819730
description:
Nov 21 10:08:04 host2 sshd[2170839]: Disconnected from invalid user actions 103.103.245.107 port 50668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 10:07:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55785: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 10:10:39 host2 sshd[2172630]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 10:10:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<SOW2aBNExsaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 10:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xgRqbxNEpo0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 10:12:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<58RncRNEWLmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 10:13:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<c/s2dRNELrGSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.222
country_id: 3175395
description:
Nov 21 10:15:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.169.222, lip=66.85.158.91, TLS, session=<LczoexNEp5q5D6ne>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.217
country_id: 953987
description:
Nov 21 10:16:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.37.217, lip=66.85.158.91, TLS, session=<DUULfRNEStJmQCXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-11-21 10:18:31 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:59154: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-21 10:19:00 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:41776: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 21 10:19:11 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS, session=<H0fbiBNEHJfCpGsG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 21 10:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.91, session=<Z1lQkRNEsE3Y2s5C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-21 10:25:56 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:46100: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 10:25:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9qpTnxNEOKcXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.29.246
country_id: 1880251
description:
Nov 21 10:27:30 host2 sshd[2184304]: Disconnected from invalid user rizal 43.156.29.246 port 34122 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.10
country_id: 2264397
description:
Nov 21 10:28:36 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.10, lip=66.85.158.91, TLS, session=<8TWJqhNEtay5tI0K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.8
country_id: 2264397
description:
Nov 21 10:28:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.8, lip=66.85.158.91, TLS, session=<H4mtqhNEDeS5tI0I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.7
country_id: 2264397
description:
Nov 21 10:28:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.7, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VSmXqhNEjMi5tI0H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.9
country_id: 2264397
description:
Nov 21 10:28:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.180.141.9, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<YLTOqhNEXai5tI0J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.10
country_id: 2264397
description:
Nov 21 10:28:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 1 secs): user=<>, rip=185.180.141.10, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<Bi3tqhNEJ865tI0K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 10:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<nm21qhNEdrGUcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 21 10:30:18 host2 sshd[2186047]: Disconnected from invalid user postgres 197.5.145.102 port 54474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 10:30:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<pz8DsRNEQtiElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:31:27 host2 sshd[2186759]: Disconnected from invalid user orange 166.170.45.118 port 29966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:32:40 host2 sshd[2187614]: Disconnected from invalid user tutor 166.170.45.118 port 58601 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:34:57 host2 sshd[2188937]: Disconnected from invalid user eric 166.170.45.118 port 29933 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 10:34:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<lgbFvhNEoNVo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 10:35:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<KWw+wxNE1ONn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:37:19 host2 sshd[2190625]: Disconnected from invalid user keycloak 166.170.45.118 port 51554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 10:37:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xsGzyRNEcNZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 10:38:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<BCMbzBNEhoh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 10:39:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<A65+0hNEOKFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 10:42:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ILXI2xNESN85gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 10:42:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+uZV3BNExJYI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.156.29.246
country_id: 1880251
description:
Nov 21 10:43:22 host2 sshd[2194752]: Disconnected from invalid user tutor 43.156.29.246 port 59808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 21 10:44:08 host2 sshd[2195319]: Disconnected from invalid user scp 197.5.145.102 port 54486 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 10:44:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WQMr4hNErSNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 10:46:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<SjQs6RNEKMlnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 10:47:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Er4q7hNEdOhz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 10:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<QQrH8xNEeKAv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 21 10:51:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@euroentertainmentlk.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<LaQ2/RNEdD4v9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 10:52:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<QCnx/hNECLRAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 10:52:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<SEbu/xNEWoVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 10:53:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<psP1BBRE/LKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.76
country_id: 798544
description:
Nov 21 10:53:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.125.249.76, lip=66.85.158.91, TLS, session=<ldr+ARREBtttfflM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.56
country_id: 1269750
description:
Nov 21 10:53:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.207.4.56, lip=66.85.158.91, TLS, session=<P10dAxREyrhnzwQ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 10:56:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aOiVDhREFMojy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 10:56:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<Ib2ZDxREwoQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 10:56:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<sRPHDxREHJgvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 10:57:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<8d7iEBREfvIjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.208
country_id: 6252001
description:
Nov 21 10:59:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.208, lip=66.85.158.92, session=<pb4gGhREuvzN0h/Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 11:01:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS, session=<n0mJIBRE5OAjy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 11:02:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<ogitIxREqjkv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 11:02:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Q8+NJBREBuOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 11:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<biImJhREtMykXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-11-21 11:04:57 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:44784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-21 11:05:14 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:44857: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.126
country_id: 3996063
description:
Nov 21 11:06:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=38.65.137.126, lip=66.85.158.91, TLS, session=<JfnGMhREfJ8mQYl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 11:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<UxaiMxRE9KII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Nov 21 11:07:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<T53ZMxRE4ZK5xQmz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 11:07:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<WrjFNhREktJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 11:08:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<sy5lNxREcpaYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:08:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Ef2ENxRE4qCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 11:08:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<UKzLORRECp9nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 11:09:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<giYjPRREePqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:13:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<PhidShREtuqElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 11:14:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<16tNTxREiJNz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 11:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<siZ4VBRElsGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 11:17:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<pWDpWRREsoJo7CMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.244
country_id: 2635167
description:
Nov 21 11:18:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.244, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XfqcXhRE69ZX7LD0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.147
country_id: 2635167
description:
Nov 21 11:18:57 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.147, lip=66.85.158.91, TLS, session=<gzSUXhREk5BX7LCT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.230
country_id: 2635167
description:
Nov 21 11:20:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.230, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<VdiTYhREqYxX7LDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 21 11:19:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z0qYYBREschX7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.219
country_id: 2635167
description:
Nov 21 11:20:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.219, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<2BOPZBRE0YNX7LDb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.247
country_id: 2635167
description:
Nov 21 11:21:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.247, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<VluKZhREIbO594n3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 11:21:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<TlkcZxRERr1n9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.161
country_id: 6252001
description:
Nov 21 11:21:31 host2 sshd[2222035]: Disconnected from invalid user admin 203.161.56.161 port 58744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.219
country_id: 2635167
description:
Nov 21 11:21:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vPyDaBREfcm594nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.252
country_id: 2635167
description:
Nov 21 11:22:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.252, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DEeBahREx9RX7LD8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Nov 21 11:22:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<CxyMbBREF5FX7LDe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Nov 21 11:23:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<DZCFbhRE499X7LD5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 11:23:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<dx+5bhREELFA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.242
country_id: 2635167
description:
Nov 21 11:23:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Ye6AcBREW5y594ny>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.161
country_id: 6252001
description:
Nov 21 11:25:09 host2 sshd[2224795]: Disconnected from invalid user newusername 203.161.56.161 port 33042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:26:08 host2 sshd[2225636]: Disconnected from invalid user zjh 154.72.233.36 port 55068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 11:26:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<CVLLeRREzo92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 11:27:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<sy1EfRRE5MQI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:28:20 host2 sshd[2227105]: Disconnected from invalid user tania 154.72.233.36 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:29:27 host2 sshd[2227811]: Disconnected from invalid user vncuser 154.72.233.36 port 45580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:29:40 host2 sshd[2227973]: Disconnected from invalid user minecraft 45.164.39.253 port 40724 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:31:11 host2 sshd[2229295]: Disconnected from invalid user deamon 45.164.39.253 port 43944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 11:31:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<XuoHjBREGKRnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 11:31:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EuNPjBREYDdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:32:39 host2 sshd[2230276]: Disconnected from invalid user ubuntu 45.164.39.253 port 47166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 11:33:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<HxypkRREECUv7YNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-11-21 11:34:31 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:50638: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-21 11:35:08 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:57670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 11:37:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<J2yyoRREAsCSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 11:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<K/SioRRENJBnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:37:48 host2 sshd[2233926]: Disconnected from invalid user dev 103.67.78.132 port 43914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 11:37:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<7FBIohREZoo5gL/H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-21 11:37:21 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:57604: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-21 11:37:29 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:55510: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 11:38:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<lH/yoxRE4qhnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:38:42 host2 sshd[2234465]: Disconnected from invalid user sahil 50.6.226.167 port 35292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 11:39:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<+2xwpxREz5IvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:40:15 host2 sshd[2235714]: Disconnected from invalid user wow 103.67.78.132 port 34622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 11:40:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wQTBqhREhI2WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:41:52 host2 sshd[2237286]: Disconnected from invalid user soporte 103.67.78.132 port 55880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:41:11 host2 sshd[2236695]: Disconnected from invalid user testuser 50.6.226.167 port 58692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 11:41:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<gyoDsBREGuRz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:42:19 host2 sshd[2237731]: Disconnected from invalid user admin 50.6.226.167 port 37978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.181.197
country_id: 732800
description:
Nov 21 11:42:51 host2 sshd[2238194]: Disconnected from invalid user wow 212.233.181.197 port 48354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 11:43:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<aSrbthREDLMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 11:43:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<IJdDtxREILJAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 21 11:43:59 host2 sshd[2239073]: Disconnected from invalid user alex 103.252.118.164 port 32068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:43:22 host2 sshd[2238684]: Disconnected from invalid user abc 50.6.226.167 port 53916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-21 11:44:44 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:52924: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 11:44:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<4r/iuhREMpBe0RIJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:44:50 host2 sshd[2239684]: Disconnected from invalid user Test 103.67.78.132 port 43262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-11-21 11:45:00 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:49000: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:45:25 host2 sshd[2240432]: Disconnected from invalid user zammad 50.6.226.167 port 51094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 21 11:45:29 host2 sshd[2240440]: Disconnected from invalid user oracle 103.252.118.164 port 63876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.181.197
country_id: 732800
description:
Nov 21 11:45:30 host2 sshd[2240484]: Disconnected from invalid user dev 212.233.181.197 port 50844 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 11:46:27 host2 sshd[2241688]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 11:46:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<brmvwRRErvkv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 11:47:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<fSMoxBRE1OqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 11:48:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Of6WxxREHOSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 11:51:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<Jz8g0RREiLeYNbyQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.233.181.197
country_id: 732800
description:
Nov 21 11:51:07 host2 sshd[2245112]: Disconnected from invalid user h3c 212.233.181.197 port 40138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:51:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<YRS30hREDJ2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 11:52:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<QPqz1BRE+tAI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 11:54:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lkFN3BRE5M+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 11:54:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<b1wv3hREfOBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:56:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Dg7W5BREWKeElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.150
country_id: 3175395
description:
Nov 21 11:58:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.168.150, lip=66.85.158.91, TLS, session=<LsGI6hREpb+5D6iW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.59.132.51
country_id: 798544
description:
Nov 21 11:58:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=193.59.132.51, lip=66.85.158.91, TLS, session=<2JaX6xREsdDBO4Qz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.242.174
country_id: 2750405
description:
Nov 21 11:58:48 host2 pure-ftpd[2251542]: (?@178.128.242.174) [INFO] New connection from 178.128.242.174


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 11:59:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<rdVc8BREOrwrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.91.32
country_id: 1819730
description:
Nov 21 12:00:54 host2 sshd[2253166]: Disconnected from invalid user mohammad 47.76.91.32 port 41130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 12:01:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<0Wcl9RRE+Mto7CMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 21 12:00:48 host2 sshd[2253107]: Disconnected from invalid user oracle 182.253.156.184 port 49052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 21 12:01:49 host2 sshd[2253934]: Disconnected from invalid user postgres 12.156.67.18 port 57382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 21 12:02:09 host2 sshd[2254129]: Disconnected from invalid user debian 182.253.156.184 port 48752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 12:02:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<CuRS+xREktuUcQQF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 12:03:31 host2 sshd[2255460]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.212.148
country_id: 3865483
description:
Nov 21 12:03:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=181.16.212.148, lip=66.85.158.91, TLS, session=<YqHO/RREA6m1ENSU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.170
country_id: 3865483
description:
Nov 21 12:04:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=181.118.183.170, lip=66.85.158.91, TLS, session=<u7ER/xREJ7u1dreq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-21 12:04:48 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:65441: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.48.39.66
country_id: 6252001
description:
2025-11-21 12:06:25 dovecot_login authenticator failed for 99-48-39-66.lightspeed.brfrct.sbcglobal.net [99.48.39.66]:45333: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 21 12:07:08 host2 sshd[2259362]: Disconnected from invalid user eris 12.156.67.18 port 57560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 12:07:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<M/1QCxVEmtdnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 12:08:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<9rcdERVEfrFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 12:09:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<HWOQERVEcuVn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 12:09:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7cFHFBVERJZA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 21 12:11:21 host2 sshd[2262677]: Disconnected from invalid user vlad 12.156.67.18 port 45230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 21 12:12:26 host2 sshd[2263684]: Disconnected from invalid user contact 12.156.67.18 port 33534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 12:12:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<N1wrHxVEooQI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 12:12:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3dS0HBVEEq0XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 21 12:13:33 host2 sshd[2264578]: Disconnected from invalid user admin 12.156.67.18 port 60096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.88
country_id: 732800
description:
Nov 21 12:14:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.253.159.88, lip=66.85.158.91, TLS, session=<OXkGJBVEJ6W5/Z9Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 12:14:41 host2 sshd[2265448]: Disconnected from invalid user anjali 62.60.131.157 port 25629 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.39.25
country_id: 2395170
description:
Nov 21 12:14:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=154.127.39.25, lip=66.85.158.91, TLS, session=<jhw3JRVEVNWafycZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-21 12:14:58 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:36126: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 12:15:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<SCqdJxVEUoR2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-11-21 12:15:13 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:57665: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-21 12:15:35 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:56422: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.112
country_id: 6252001
description:
Nov 21 12:16:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.112, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P2fHLRVET8iTuYRw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 12:17:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<80f1LxVEOKRnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 12:17:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<vZyRMBVEAIsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 12:19:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<sEdWNRVErwhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 12:21:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<YZydPxVEtowvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 12:24:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<BHiaSBVE7L9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 12:26:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<B3ChUBVEQK2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-11-21 12:26:59 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:41540: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-21 12:27:15 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:52034: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 12:30:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<oY63XxVEKuErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 12:31:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<5fH3YBVEjqYv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 12:31:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ySJfYhVExtOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 12:33:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<Py0IaBVEcsI5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 12:34:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<i85UaxVECqaYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-21 12:34:42 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:52587: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 12:34:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<lvbebRVEZoGElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-21 12:34:54 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:52036: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 12:35:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cC+SbxVE5JGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 12:36:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<0TEEchVEWo9nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 12:36:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<cDnSchVEBr1z8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 12:37:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<X9/SdxVEtpAI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 12:39:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=</2kEfRVERhanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 12:39:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<XwIsgBVEhI2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 12:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<gEhphxVEKIBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 12:44:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<yk1DkBVELpRo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 12:47:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<nHv9mRVEHN0rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.40.49.207
country_id: 6252001
description:
2025-11-21 12:47:58 dovecot_plain authenticator failed for ([10.1.15.14]) [149.40.49.207]:1922: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.144
country_id: 3175395
description:
Nov 21 12:48:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.77.50.144, lip=66.85.158.91, TLS, session=<OP1snxVEerS5TTKQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.40.49.207
country_id: 6252001
description:
Nov 21 12:48:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=149.40.49.207, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+tKBnhVE8AmVKDHP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.228
country_id: 3175395
description:
Nov 21 12:48:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.179.228, lip=66.85.158.91, TLS, session=<j6BdnhVEStXZGrPk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.55
country_id: 2510769
description:
Nov 21 12:50:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=139.28.190.55, lip=66.85.158.91, TLS, session=<zV0hpBVEWpyLHL43>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.94
country_id: 3175395
description:
Nov 21 12:50:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=185.197.9.94, lip=66.85.158.91, TLS, session=<2Zo3pRVEpci5xQle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 12:51:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<a58nqRVE8I2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 21 12:53:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@euroentertainmentlk.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<nn3wrhVEMNgv9XzN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-21 12:53:25 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:37862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-21 12:53:38 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:32965: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 12:54:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<XMOctRVEULxn9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.39
country_id: 1880251
description:
Nov 21 12:56:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=139.99.35.39, lip=66.85.158.92, session=<cGcwuxVEQeKLYyMn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.99.35.45
country_id: 1880251
description:
Nov 21 12:56:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 23 secs): user=<>, rip=139.99.35.45, lip=66.85.158.92, session=<G9SFvBVENd6LYyMt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.237
country_id: 6252001
description:
Nov 21 12:58:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.237, lip=66.85.158.91, session=<zSQ/wRVEeeXDuEzt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.233
country_id: 6252001
description:
Nov 21 12:58:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.233, lip=66.85.158.91, session=<+YPlwRVEQZLDuEzp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.238
country_id: 6252001
description:
Nov 21 12:58:23 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.238, lip=66.85.158.91, session=<F6U1whVEG5XDuEzu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 12:58:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<i84ewhVENKRA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.14
country_id: 6252001
description:
Nov 21 12:58:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.14, lip=66.85.158.91, session=<fdJlwhVEMbTDuEwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 13:02:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<J9Vb0BVEDCUv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 13:02:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<8tJz0hVECJhz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 13:03:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<jBvy0xVEJuBnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 13:04:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<c+pb1hVE5qh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 13:04:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<cCee2BVEBYcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 13:04:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=</faX2RVERMRnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 13:09:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<w+cH6BVEEh9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 13:10:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<FOkp7hVEKuBnoNQc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.228.163
country_id: 1643084
description:
Nov 21 13:11:28 host2 pure-ftpd[2316193]: (?@165.154.228.163) [INFO] New connection from 165.154.228.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 13:13:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<cHeg9xVEotGWXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.228.163
country_id: 1643084
description:
Nov 21 13:15:04 host2 pure-ftpd[2319299]: (?@165.154.228.163) [INFO] New connection from 165.154.228.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 13:15:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<t9uoABZEvNMv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 13:15:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<7ITYABZEPLekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 13:17:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<f4VxBxZEtNeYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.26
country_id: 798544
description:
Nov 21 13:17:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=128.127.94.26, lip=66.85.158.91, TLS, session=<FcGJBhZEyuCAf14a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.56
country_id: 298795
description:
Nov 21 13:18:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=94.78.89.56, lip=66.85.158.91, TLS, session=<liedBxZE/M9eTlk4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 13:18:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<kTyLChZE3LMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 13:18:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<mgGACxZESuqElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 13:19:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<VKnTCxZEBOZe0RIJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.17.89
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.17.89 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 13:21:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<eFEXFRZEnIql6LP6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.162.214.96
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.162.214.96 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.35.46
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 111.119.35.46 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.106.28.167
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.106.28.167 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.9.162.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.9.162.31 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.113.96.12
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.113.96.12 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 13:23:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<9ceQGxZEkGmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 13:24:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<G9jsHRZEDouElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 21 13:25:29 host2 sshd[2326148]: Disconnected from invalid user images 75.159.69.29 port 43008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.90.194.158
country_id: 3469034
description:
Nov 21 13:26:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=189.90.194.158, lip=66.85.158.91, TLS, session=<AP7kJhZExYq9WsKe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.12
country_id: 2510769
description:
Nov 21 13:27:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=185.214.138.12, lip=66.85.158.91, TLS, session=<CL1hKBZEQqO51ooM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 21 13:27:27 host2 sshd[2327609]: Disconnected from invalid user xyx 107.172.155.3 port 53194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Nov 21 13:27:44 host2 sshd[2327777]: Disconnected from invalid user ac 185.208.156.50 port 47880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 13:28:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<wnkxLRZEOLpo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 13:28:49 host2 sshd[2328540]: Disconnected from invalid user daisha 62.60.131.157 port 14481 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 21 13:29:24 host2 sshd[2328887]: Disconnected from invalid user ftpadmin 107.172.155.3 port 53030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 13:29:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<N5yHMhZEktxz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 13:29:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<06x1MBZE/I1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 13:29:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<LWOPMBZESrU5gL/H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 21 13:31:18 host2 sshd[2330291]: Disconnected from invalid user xyx 75.159.69.29 port 44872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.156.50
country_id: 241170
description:
Nov 21 13:31:29 host2 sshd[2330355]: Disconnected from invalid user user 185.208.156.50 port 43944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 21 13:32:32 host2 sshd[2331056]: Disconnected from invalid user zhaomin 75.159.69.29 port 48228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Nov 21 13:33:31 host2 sshd[2331612]: Disconnected from invalid user ari 185.208.156.50 port 34460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.247.41
country_id: 1269750
description:
Nov 21 13:33:32 host2 sshd[2331631]: Disconnected from invalid user ari 49.207.247.41 port 42629 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.255.46.174
country_id: 2186224
description:
Nov 21 13:33:36 host2 sshd[2331661]: Disconnected from invalid user images 123.255.46.174 port 41504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 13:33:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<xiOZQBZEWuRe0RIJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 21 13:33:47 host2 sshd[2331818]: Disconnected from invalid user zhaomin 107.172.155.3 port 34520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 13:34:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<i/hgQhZEXtZnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 13:35:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<MlFNRRZEANQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.255.46.174
country_id: 2186224
description:
Nov 21 13:35:19 host2 sshd[2332948]: Disconnected from invalid user service 123.255.46.174 port 38222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 21 13:36:32 host2 sshd[2333646]: Disconnected from invalid user nutanix 95.39.201.205 port 52532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 75.159.69.29
country_id: 6251999
description:
Nov 21 13:36:17 host2 sshd[2333524]: Disconnected from invalid user service 75.159.69.29 port 58298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Nov 21 13:37:49 host2 sshd[2334626]: Disconnected from invalid user nvr 185.208.156.50 port 55804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 13:38:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<Fo1gURZEPpyUcQQF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 13:39:26 host2 sshd[2335638]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.247.41
country_id: 1269750
description:
Nov 21 13:39:57 host2 sshd[2335914]: Disconnected from invalid user ismael 49.207.247.41 port 41758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.255.46.174
country_id: 2186224
description:
Nov 21 13:40:28 host2 sshd[2336355]: Disconnected from invalid user produccion 123.255.46.174 port 48706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.116
country_id: 953987
description:
Nov 21 13:41:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=102.64.39.116, lip=66.85.158.91, TLS, session=<S1K8XBZE5dhmQCd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.56.60.121
country_id: 298795
description:
2025-11-21 13:42:03 dovecot_login authenticator failed for ([31.56.60.121]) [31.56.60.121]:59438: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 13:41:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<PeD4WxZEdptn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-21 13:41:35 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:48866: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 21 13:41:43 host2 sshd[2337136]: Disconnected from invalid user test 95.39.201.205 port 50308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.253
country_id: 1269750
description:
Nov 21 13:42:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<art>, method=PLAIN, rip=103.55.105.253, lip=66.85.158.91, TLS, session=<XRsUXhZEJrhnN2n9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 21 13:43:41 host2 sshd[2338551]: Disconnected from invalid user discord 95.39.201.205 port 40748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 21 13:44:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<qba/ZRZE8N5ChJmO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Nov 21 13:44:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, TLS, session=<taGeZhZEOJHAm1rc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 13:44:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60164: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-21 13:45:04 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:40299: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 21 13:44:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS, session=<Ok/YZRZETN5ChJmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 13:45:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<BCPwaRZEcOpA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-21 13:45:22 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:49204: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.8
country_id: 1605651
description:
Nov 21 13:45:51 host2 pure-ftpd[2340446]: (?@103.176.152.8) [INFO] New connection from 103.176.152.8


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 13:46:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<Q8kKbxZEfLdAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 13:47:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<M4xTcRZEXIAvWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 21 13:47:34 host2 sshd[2341394]: Disconnected from invalid user ftptest 95.39.201.205 port 59636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 13:47:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<n4PQcBZEZNcv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 13:49:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<eHLZdxZErrVnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 13:54:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<DM+LiRZE5rc+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 13:53:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<raDuhhZE6qV2wSaf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 13:56:29 host2 sshd[2348318]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 13:56:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<g9PtkhZEYM1z8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 13:56:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZF8dkxZEuRRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 13:57:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<qM4AlBZEROxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Nov 21 13:59:45 host2 sshd[2350693]: Disconnected from invalid user user 157.230.211.219 port 43820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 14:00:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<cXzboRZENOMv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 14:00:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Qr8aoBZEPKmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.5
country_id: 3175395
description:
Nov 21 14:00:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=185.77.50.5, lip=66.85.158.91, TLS, session=<px6InxZEoqO5TTIF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 14:00:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bIh9oRZEFMKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Nov 21 14:00:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<ZrCroBZEB+2xgqgd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Nov 21 14:01:24 host2 sshd[2352349]: Disconnected from invalid user vaibhav 74.243.236.86 port 40750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 14:01:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<ghHapBZEyMuYNbyQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 21 14:01:50 host2 sshd[2352642]: Disconnected from invalid user myuser 46.20.111.2 port 53554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Nov 21 14:02:49 host2 sshd[2353310]: Disconnected from invalid user sftpuser1 74.243.236.86 port 38604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 21 14:02:56 host2 sshd[2353381]: Disconnected from invalid user shivam 46.20.111.2 port 37006 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 21 14:03:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.12, lip=66.85.158.91, TLS, session=<bxmMqRZEsPuTuYQM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Nov 21 14:03:39 host2 sshd[2354239]: Disconnected from invalid user minecraft 157.230.211.219 port 58800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 14:03:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<vXo8rBZEJJpnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Nov 21 14:03:21 host2 sshd[2354008]: Disconnected from invalid user webuser 101.47.162.24 port 42006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 14:03:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<gqbkqhZEsuyElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Nov 21 14:04:12 host2 sshd[2354605]: Disconnected from invalid user erp 74.243.236.86 port 34966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 21 14:06:06 host2 sshd[2355874]: Disconnected from invalid user testuser 46.20.111.2 port 39872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Nov 21 14:05:52 host2 sshd[2355739]: Disconnected from invalid user test 101.47.162.24 port 41116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 14:06:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<vlOptRZEBJYrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 21 14:07:17 host2 sshd[2356582]: Disconnected from invalid user erp 152.32.218.244 port 34054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 21 14:07:17 host2 sshd[2356597]: Disconnected from invalid user oracle 46.20.111.2 port 37302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 14:07:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<cQkbuhZEIHanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 14:07:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rFLOuhZEIoml6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 21 14:08:36 host2 sshd[2357191]: Disconnected from invalid user user 46.20.111.2 port 46932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 14:08:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<NBi9vRZESo6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.41.220
country_id: 6290252
description:
Nov 21 14:08:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=109.207.41.220, lip=66.85.158.91, TLS, session=<QmNXvRZE6IRtzync>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.156
country_id: 6252001
description:
Nov 21 14:08:22 host2 pure-ftpd[2357132]: (?@205.210.31.156) [INFO] New connection from 205.210.31.156


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.50
country_id: 3175395
description:
Nov 21 14:09:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.169.50, lip=66.85.158.91, TLS, session=<CsdtvhZEF+q5D6ky>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Nov 21 14:09:27 host2 sshd[2357665]: Disconnected from invalid user rex 157.230.211.219 port 41968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 21 14:09:33 host2 sshd[2357702]: Disconnected from invalid user david 177.89.170.4 port 59892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 14:12:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<SivbyRZECMBo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.211.219
country_id: 6252001
description:
Nov 21 14:13:19 host2 sshd[2360572]: Disconnected from invalid user admin 157.230.211.219 port 44192 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 14:13:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<A4l0zxZE1oNe0RIJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.32.116
country_id: 2510769
description:
Nov 21 14:15:00 host2 sshd[2361496]: Disconnected from invalid user myuser 46.24.32.116 port 11155 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 14:16:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<1Qat2RZE4Jtn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 14:16:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<eB/o2RZExqY+PIOI>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 70.184.117.114
country_id: 6252001
description:
Nov 21 14:19:38 host2 sshd[2364811]: Disconnecting authenticating user root 70.184.117.114 port 56208: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 70.184.117.114
country_id: 6252001
description:
Nov 21 14:19:38 host2 sshd[2364811]: error: maximum authentication attempts exceeded for root from 70.184.117.114 port 56208 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 21 14:20:02 host2 sshd[2365294]: Disconnected from invalid user username 177.89.170.4 port 35194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 14:20:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<yoz95hZEcKlAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Nov 21 14:21:26 host2 sshd[2366519]: Disconnected from invalid user shivam 101.47.162.24 port 53114 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 21 14:21:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@euroentertainmentlk.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<dNK/6xZEdusv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 14:22:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hUoQ8BZEDMErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 14:24:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<TK5/9BZEVIxz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 21 14:24:34 host2 sshd[2369367]: Disconnected from invalid user ircd 177.89.170.4 port 56190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 14:25:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<DXSb+BZEwLqUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 14:26:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<pmFc/hZEiOs5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 14:28:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Zq1sAxdEqqln9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 14:30:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<1/EcCxdER3ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 14:32:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<PuJ6ExdEpN0v7YNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-21 14:32:45 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:36248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-21 14:33:00 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:27519: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 14:32:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eQm5EhdE9I5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 14:33:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=</Q3GFhdEvMBnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 14:35:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<aMFdHBdE6IZnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 14:42:38 host2 sshd[2386595]: Disconnected from invalid user myra 62.60.131.157 port 27650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 14:43:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<03h0ORdE/s52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 14:43:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<sRq0OhdEoIJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 14:45:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GQB7QBdEwi1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 14:45:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<lpE9QhdEStGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.78
country_id: 798544
description:
Nov 21 14:46:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=109.125.244.78, lip=66.85.158.91, TLS, session=<6G9iQhdEdLptffRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 14:46:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<z8N+RBdEtNyYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.237
country_id: 3469034
description:
Nov 21 14:46:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.247.237, lip=66.85.158.91, TLS, session=<cMp/QxdEz9K60fft>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 14:46:47 host2 sshd[2391030]: Disconnected from invalid user oracle 41.83.197.23 port 40776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 14:46:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<8+bZRRdEatcv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 14:47:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bJEPSRdENIKWXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 21 14:48:32 host2 pure-ftpd[2392900]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 14:48:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<SJkGTBdElo2ElIx5>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Nov 21 14:48:36 host2 pure-ftpd[2393007]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.196
country_id: 6252001
description:
Nov 21 14:51:11 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.188.196, lip=66.85.158.92, session=<8xOVVRdEUp0s3LzE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 14:51:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<UTyWVhdE6uhz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 21 14:52:43 host2 sshd[2397145]: Disconnected from invalid user app 200.196.50.91 port 45735 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 14:52:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<uYrBWhdEHj6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 14:53:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<zyH4XhdE8J2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 14:54:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<j1R5YRdEfs8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.230
country_id: 3469034
description:
Nov 21 14:54:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=179.189.199.230, lip=66.85.158.91, TLS, session=<kT0pYRdEadazvcfm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 14:54:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<4kjCYhdEotWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.219
country_id: 3469034
description:
Nov 21 14:54:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.250.219, lip=66.85.158.91, TLS, session=<rDvsXxdEt7C60frb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 21 14:55:31 host2 sshd[2400294]: Disconnected from invalid user riccardo 200.196.50.91 port 40174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 14:56:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<O0YoaBdEAt1o7CMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 21 14:56:58 host2 sshd[2401592]: Disconnected from invalid user test 200.196.50.91 port 55297 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 14:59:44 host2 sshd[2403551]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 21 14:59:54 host2 sshd[2403760]: Disconnected from invalid user paul 200.196.50.91 port 57284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 15:03:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<LrDQghdEZItnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 15:04:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<dQlghBdEmKln76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 21 15:06:45 host2 sshd[2409812]: Disconnected from invalid user demo 185.158.22.150 port 28603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 15:08:40 host2 sshd[2411132]: Disconnected from invalid user manager 41.83.197.23 port 57400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 15:11:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<B891nBdEFIUrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Nov 21 15:12:13 host2 sshd[2414943]: Disconnected from invalid user linus 185.158.22.150 port 49994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 15:12:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<qvQOoRdEKsaUcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 21 15:13:24 host2 sshd[2415969]: Disconnected from invalid user odoo 185.158.22.150 port 23818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 15:14:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<y4RwpxdEgm0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 15:16:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<FlngrhdEiJNn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 15:19:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<zKo0uhdE9OFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 15:19:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<zjYluhdEmkov7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 15:20:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1a2WvRdEsN9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 15:21:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<Jcw0wxdEdIJnmSo4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:23:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5SjLyBdEFKcDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 15:25:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<HM+AzxdEbrk5gL/H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:25:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RIPC0RdEIs0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:26:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<w7aW0hdEFIkDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 151.237.57.13
country_id: 2510769
description:
Nov 21 15:26:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=151.237.57.13, lip=66.85.158.91, TLS, session=<yKn80xdENtyX7TkN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.136
country_id: 2300660
description:
Nov 21 15:27:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.0.136, lip=66.85.158.91, TLS, session=<S/cg1RdER4EpiwCI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:27:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WR5Z1xdEUKsDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:28:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6Ulm2xdExOYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:29:39 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<yd0r3xdE/p0DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 15:30:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<s8uY4hdEbotnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 15:30:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<mp4v4xdEnrikXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:30:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<toz64BdE7LEDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 15:31:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<Dgms5BdEgoqYNbyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:31:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<GbJJ5xdEzMcDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 15:32:20 host2 sshd[2428236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 15:32:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<Tzp/6RdEPIxAF4KF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:32:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<qOaK6BdEjoYDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 15:33:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<FepJ7RdEhLh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 15:33:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<XDJM7RdEyCsv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 21 15:33:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<6l+B7hdEqs4DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 15:34:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<zCwV7xdEIqiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 15:34:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<N0687xdE/MJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 15:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tPN38hdE4EVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 15:35:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wCcS9BdERqGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 15:37:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ve3N/BdEFJanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 15:39:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Ek+GAhhEZL2ElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 15:39:51 host2 sshd[2433762]: Disconnected from invalid user dallin 62.60.131.157 port 21476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 15:40:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<tVv0BBhEMuJo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 15:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5IgjCxhEoLOl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 6251999
description:
Nov 21 15:42:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=86.54.31.40, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<X5qIDRhE7KlWNh8o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 15:42:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hVfeDRhEPrkrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.215
country_id: 3017382
description:
Nov 21 15:46:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.215, lip=66.85.158.91, session=<0XpkHBhEG7hb51nX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.80
country_id: 3017382
description:
Nov 21 15:46:59 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.80, lip=66.85.158.91, session=<tmElHRhETdpb51lQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.84
country_id: 3017382
description:
Nov 21 15:47:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.84, lip=66.85.158.91, session=<7p1XHRhE2bhb51lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Nov 21 15:46:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.209, lip=66.85.158.91, session=<Z3HHGxhEa9Bb51nR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 15:47:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<hGSGHhhEgt5z8UML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-11-21 15:47:27 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (ancenress) [2.135.31.74]:37915: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 15:49:22 host2 sshd[2452843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.88.34.53
country_id: 6252001
description:
Nov 21 15:49:16 host2 sshd[2452785]: Disconnected from invalid user odoo 47.88.34.53 port 49536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:52:20 host2 sshd[2454757]: Disconnected from invalid user red 187.33.158.113 port 60662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 15:52:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<w/BwMRhEardn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 15:56:04 host2 sshd[2457693]: Disconnected from invalid user dallin 62.60.131.157 port 34808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-21 15:56:06 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:37042: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-21 15:55:41 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:53310: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:56:55 host2 sshd[2458098]: Disconnected from invalid user odoo 187.33.158.113 port 34336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 15:58:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<m7GPRBhEo1YvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 15:59:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hqYmSRhE8s4rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.158.113
country_id: 2510769
description:
Nov 21 15:59:37 host2 sshd[2459557]: Disconnected from invalid user mati 187.33.158.113 port 35518 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 15:59:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<YsntShhELo2UcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:04:22 host2 sshd[2463602]: Disconnected from invalid user lm 41.83.197.23 port 38168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 16:04:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<E5lzXBhE9oBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 16:04:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<umyvXBhEyoFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 16:04:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<eaHzXBhEhts+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:06:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<ZY9HZBhEJk8v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 16:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<NPl9ZBhEfoxAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 16:08:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<T85SaBhEop5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 16:08:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<cKRkaxhEhKBnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 16:15:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<F8iAghhEJIxz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 16:16:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<GnNAhRhEsLqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 16:16:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<UVUohhhEkquYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 16:17:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<UNpgixhExotnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 16:20:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<TlsckxhEuNaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 16:20:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<unphlRhEwuWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:21:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<kF9LmBhEIt4v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<NeBNoBhEkOE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dQFFoBhETMmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 16:24:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<XMisoRhEIpR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 16:24:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ILC4oRhEhOE5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 16:23:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<oNhQoBhEPvanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 16:24:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<34nzoRhEZxNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 16:24:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<wwn3oRhENuZo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:25:16 host2 sshd[2476272]: Disconnected from invalid user sia 204.152.195.145 port 35872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 16:26:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<nIYUqRhEkI2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 16:26:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<LKz+qRhEOKZAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:26:31 host2 sshd[2477031]: Disconnected from invalid user terra 204.152.195.145 port 35998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:27:22 host2 sshd[2477468]: Disconnected from invalid user test 103.4.92.103 port 36328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:28:10 host2 sshd[2478030]: Disconnected from invalid user gh 41.83.197.23 port 50502 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.85.105.108
country_id: 3469034
description:
Nov 21 16:28:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=187.85.105.108, lip=66.85.158.91, session=<Le0mshhEBMS7VWls>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 16:28:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<X+ISsxhEVoGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.52
country_id: 3175395
description:
Nov 21 16:29:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.179.52, lip=66.85.158.91, TLS, session=<TahvsxhEfNvZGrM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 16:29:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<6jmftRhE4N2SOC+J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:30:34 host2 sshd[2479980]: Disconnected from invalid user zero 204.152.195.145 port 36398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-21 16:30:39 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:46458: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-21 16:30:54 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:33662: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.83.197.23
country_id: 2245662
description:
Nov 21 16:32:04 host2 sshd[2481068]: Disconnected from invalid user sfc 41.83.197.23 port 57794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 16:31:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<CHfOuxhEGNQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.152.195.145
country_id: 6252001
description:
Nov 21 16:31:58 host2 sshd[2480991]: Disconnected from invalid user admin 204.152.195.145 port 36526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.10.97.94
country_id: 1643084
description:
2025-11-21 16:33:49 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [182.10.97.94]:29551: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.6
country_id: 2264397
description:
Nov 21 16:34:36 host2 pure-ftpd[2482504]: (?@185.226.198.6) [INFO] New connection from 185.226.198.6


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 21 16:34:39 host2 pure-ftpd[2482541]: (?@185.226.198.7) [INFO] New connection from 185.226.198.7


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.4
country_id: 2264397
description:
Nov 21 16:34:47 host2 pure-ftpd[2482641]: (?@185.226.198.4) [INFO] New connection from 185.226.198.4


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.226.198.5
country_id: 2264397
description:
Nov 21 16:34:47 host2 pure-ftpd[2482649]: (?@185.226.198.5) [INFO] New connection from 185.226.198.5


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:34:23 host2 sshd[2482405]: Disconnected from invalid user admin 103.4.92.103 port 42195 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 16:36:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<k76czxhEpLdnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:36:08 host2 sshd[2483501]: Disconnected from invalid user wg 103.4.92.103 port 57773 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.153
country_id: 3175395
description:
Nov 21 16:41:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.208.106.153, lip=66.85.158.91, TLS, session=<CUGG3RhEeae50GqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.124
country_id: 3175395
description:
Nov 21 16:40:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=217.26.179.124, lip=66.85.158.91, TLS, session=<69M33BhEaLDZGrN8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 16:41:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<kVNV3xhEOsVn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.92.103
country_id: 1168579
description:
Nov 21 16:41:34 host2 sshd[2486837]: Disconnected from invalid user terra 103.4.92.103 port 48051 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 16:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<KvTA4RhEFkAvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 16:43:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<BVSt5xhEYqFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 16:45:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<s3mq7BhEhs4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.44.160.11
country_id: 149590
description:
2025-11-21 16:46:45 dovecot_plain authenticator failed for (B9MP3) [196.44.160.11]:53929: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 16:47:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<Q7CF9RhEkOGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 16:48:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<6Hi49xhE1NMrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.44.160.11
country_id: 149590
description:
2025-11-21 16:50:40 dovecot_login authenticator failed for (B9MP3) [196.44.160.11]:53929: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 16:55:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<gD8vEhlE0Fgv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 16:56:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<lwciFBlE9shA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.178.126
country_id: 6252001
description:
Nov 21 16:57:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=159.223.178.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wutcGhlEesKf37J+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-11-21 17:00:00 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:62726: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-21 17:00:13 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:36589: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 17:01:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<85DUJhlExK1AF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 17:01:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<0qUXKBlECtVn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 17:01:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<EiE5KRlENLikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 17:02:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<7LqqKhlEoq2YNbyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.178.126
country_id: 6252001
description:
Nov 21 17:03:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.178.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bSRDLhlEyLCf37J+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:03:46 host2 sshd[2500993]: Disconnected from invalid user last 46.28.24.69 port 48560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:06:48 host2 sshd[2503014]: Disconnected from invalid user admin 46.28.24.69 port 41664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:07:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<75a2PRlELrqElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:08:30 host2 sshd[2503986]: Disconnected from invalid user mark 182.8.228.154 port 3827 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 17:08:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<IlYZQBlE3JFo7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.28.24.69
country_id: 3175395
description:
Nov 21 17:09:49 host2 sshd[2504692]: Disconnected from invalid user ica 46.28.24.69 port 54450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 17:10:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<vTdmRhlE0O+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 17:10:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<+lTERxlE5rAv7YNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.142.173.63
country_id: 294640
description:
2025-11-21 17:11:16 dovecot_login authenticator failed for ([37.142.173.63]) [37.142.173.63]:48628: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-21 17:11:19 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53954: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-11-21 17:11:42 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:56032: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.184.94.75
country_id: 2328926
description:
2025-11-21 17:12:04 dovecot_login authenticator failed for 41-184-94-75.rv.ipnxtelecoms.com ([102.164.35.116]) [41.184.94.75]:39532: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 17:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Q2hvTRlETJmWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:12:18 host2 sshd[2506618]: Disconnected from invalid user seafile 182.8.228.154 port 63894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 17:12:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<RMCITxlE5qoFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:13:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<OaOfURlEENKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 17:13:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Ti3XURlEapJz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:13:56 host2 sshd[2507615]: Disconnected from invalid user huser 89.97.218.142 port 34168 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:13:58 host2 sshd[2507630]: Disconnected from invalid user karol 182.8.228.154 port 30154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-21 17:14:11 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:53170: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-21 17:14:21 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:40072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 17:15:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kBMRWBlE1Stniu0S>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.226.254
country_id: 99237
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 185.75.226.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.94.250.47
country_id: 953987
description:
[2025-11-21 17:16:05 +0530] info [whostmgrd] 197.94.250.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.123.170
country_id: 3865483
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 190.105.123.170 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.67.187.246
country_id: 2635167
description:
[2025-11-21 17:15:42 +0530] info [cpaneld] 5.67.187.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.75.120
country_id: 6252001
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 107.216.75.120 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.160.168.67
country_id: 1820814
description:
[2025-11-21 17:15:50 +0530] info [cpaneld] 119.160.168.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.30.97.9
country_id: 587116
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 81.30.97.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.77.212.242
country_id: 1282988
description:
[2025-11-21 17:15:51 +0530] info [cpaneld] 103.77.212.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.73.168.111
country_id: 390903
description:
[2025-11-21 17:15:55 +0530] info [cpaneld] 85.73.168.111 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.37.224.82
country_id: 1269750
description:
[2025-11-21 17:15:56 +0530] info [cpaneld] 49.37.224.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.165.64
country_id: 1269750
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 103.134.165.64 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.49.15.5
country_id: 1694008
description:
[2025-11-21 17:15:56 +0530] info [whostmgrd] 27.49.15.5 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.253.3
country_id: 3865483
description:
[2025-11-21 17:16:00 +0530] info [cpaneld] 186.22.253.3 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.94.10.200
country_id: 1694008
description:
[2025-11-21 17:16:02 +0530] info [whostmgrd] 119.94.10.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.110.16.103
country_id: 1269750
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 103.110.16.103 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.22.175.222
country_id: 3996063
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 38.22.175.222 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.93.221
country_id: 1269750
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 49.43.93.221 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.108.91.61
country_id: 3469034
description:
[2025-11-21 17:15:44 +0530] info [cpaneld] 187.108.91.61 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.234.142.84
country_id: 2921044
description:
[2025-11-21 17:15:45 +0530] info [cpaneld] 93.234.142.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.207.175.254
country_id: 6252001
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 68.207.175.254 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.158.203.54
country_id: 690791
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 78.158.203.54 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.70.73
country_id: 3469034
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 45.172.70.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.248.86.210
country_id: 2017370
description:
[2025-11-21 17:15:58 +0530] info [cpaneld] 109.248.86.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.123.246
country_id: 3865483
description:
[2025-11-21 17:16:01 +0530] info [whostmgrd] 186.19.123.246 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.49.119.61
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 45.49.119.61 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.42.228.9
country_id: 1210997
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 103.42.228.9 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.236.97
country_id: 1733045
description:
[2025-11-21 17:15:58 +0530] info [whostmgrd] 180.75.236.97 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.226.32.163
country_id: 3996063
description:
[2025-11-21 17:16:02 +0530] info [whostmgrd] 177.226.32.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.184.201.26
country_id: 2017370
description:
[2025-11-21 17:16:02 +0530] info [cpaneld] 109.184.201.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.79.80
country_id: 1269750
description:
[2025-11-21 17:16:03 +0530] info [cpaneld] 49.36.79.80 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 17:15:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<MwQ1WhlELq52wSaf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.194.200.204
country_id: 1694008
description:
[2025-11-21 17:15:47 +0530] info [cpaneld] 180.194.200.204 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.220.41.69
country_id: 99237
description:
[2025-11-21 17:15:51 +0530] info [cpaneld] 91.220.41.69 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.253.212.147
country_id: 298795
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 212.253.212.147 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.51.45.201
country_id: 290557
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 2.51.45.201 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.47
country_id: 99237
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 62.201.244.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.134.19
country_id: 6252001
description:
[2025-11-21 17:16:01 +0530] info [cpaneld] 45.50.134.19 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.81.177.53
country_id: 2510769
description:
[2025-11-21 17:15:42 +0530] info [cpaneld] 66.81.177.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.238.48.81
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 71.238.48.81 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.56.193.175
country_id: 99237
description:
[2025-11-21 17:16:01 +0530] info [cpaneld] 185.56.193.175 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.136.148.227
country_id: 99237
description:
[2025-11-21 17:15:57 +0530] info [cpaneld] 185.136.148.227 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.50.215
country_id: 1694008
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 136.158.50.215 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.202.234.78
country_id: 1694008
description:
[2025-11-21 17:16:03 +0530] info [cpaneld] 112.202.234.78 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:15:33 host2 sshd[2508837]: Disconnected from invalid user last 172.172.130.40 port 35962 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.224.161.139
country_id: 3469034
description:
[2025-11-21 17:15:46 +0530] info [cpaneld] 45.224.161.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.124.209.108
country_id: 6252001
description:
[2025-11-21 17:15:47 +0530] info [cpaneld] 209.124.209.108 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.79.36.121
country_id: 2963597
description:
[2025-11-21 17:15:56 +0530] info [cpaneld] 109.79.36.121 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.25.56.50
country_id: 1643084
description:
[2025-11-21 17:16:01 +0530] info [whostmgrd] 160.25.56.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.250.11
country_id: 1733045
description:
[2025-11-21 17:16:06 +0530] info [whostmgrd] 27.125.250.11 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.218.208
country_id: 1605651
description:
[2025-11-21 17:15:45 +0530] info [cpaneld] 182.232.218.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.66.225
country_id: 1512440
description:
[2025-11-21 17:15:48 +0530] info [cpaneld] 84.54.66.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.119.180
country_id: 99237
description:
[2025-11-21 17:15:53 +0530] info [whostmgrd] 212.237.119.180 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.188.56.180
country_id: 6252001
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 71.188.56.180 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.122.59.105
country_id: 1605651
description:
[2025-11-21 17:15:50 +0530] info [cpaneld] 124.122.59.105 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.129.77.20
country_id: 6252001
description:
[2025-11-21 17:15:54 +0530] info [cpaneld] 142.129.77.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.70.217.136
country_id: 6252001
description:
[2025-11-21 17:16:00 +0530] info [whostmgrd] 174.70.217.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.198.4
country_id: 6252001
description:
[2025-11-21 17:16:02 +0530] info [cpaneld] 76.167.198.4 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.229.252.76
country_id: 1269750
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 223.229.252.76 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.225.12
country_id: 1733045
description:
[2025-11-21 17:16:05 +0530] info [cpaneld] 180.74.225.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.32.99.9
country_id: 1694008
description:
[2025-11-21 17:15:43 +0530] info [cpaneld] 152.32.99.9 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.24.210.42
country_id: 6252001
description:
[2025-11-21 17:15:49 +0530] info [cpaneld] 8.24.210.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.229.120.129
country_id: 6252001
description:
[2025-11-21 17:15:55 +0530] info [cpaneld] 73.229.120.129 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.25.59.114
country_id: 1694008
description:
[2025-11-21 17:15:59 +0530] info [cpaneld] 223.25.59.114 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.228.125
country_id: 102358
description:
[2025-11-21 17:16:15 +0530] info [cpaneld] 188.53.228.125 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.0.72
country_id: 290557
description:
[2025-11-21 17:16:18 +0530] info [cpaneld] 5.107.0.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 17:16:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GEnpXBlEht6l6LP6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.160.143.250
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 174.160.143.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.29.91
country_id: 1733045
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 60.50.29.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.66.85
country_id: 3895114
description:
[2025-11-21 17:16:22 +0530] info [cpaneld] 179.60.66.85 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.0.149.165
country_id: 2017370
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 193.0.149.165 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.140.24.49
country_id: 390903
description:
[2025-11-21 17:16:10 +0530] info [cpaneld] 91.140.24.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.198.199.67
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 24.198.199.67 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.194.68.121
country_id: 6252001
description:
[2025-11-21 17:16:25 +0530] info [cpaneld] 108.194.68.121 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.181.68.197
country_id: 6252001
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 70.181.68.197 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.87.84.84
country_id: 1643084
description:
[2025-11-21 17:16:15 +0530] info [cpaneld] 210.87.84.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.164.92.113
country_id: 6252001
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 216.164.92.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.178.133.28
country_id: 6252001
description:
[2025-11-21 17:16:23 +0530] info [cpaneld] 70.178.133.28 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.129.147
country_id: 587116
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 62.217.129.147 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.67.6
country_id: 1282988
description:
[2025-11-21 17:16:19 +0530] info [cpaneld] 27.34.67.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.85.226.4
country_id: 3469034
description:
[2025-11-21 17:16:22 +0530] info [cpaneld] 177.85.226.4 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.130.188.30
country_id: 1210997
description:
[2025-11-21 17:16:07 +0530] info [cpaneld] 114.130.188.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.16.55.8
country_id: 2215636
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 165.16.55.8 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.48.197.207
country_id: 1269750
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 103.48.197.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.219.32
country_id: 1282988
description:
[2025-11-21 17:16:11 +0530] info [cpaneld] 103.134.219.32 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.122.136
country_id: 3865483
description:
[2025-11-21 17:16:30 +0530] info [cpaneld] 190.105.122.136 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.15.59.59
country_id: 298795
description:
[2025-11-21 17:16:34 +0530] info [cpaneld] 95.15.59.59 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.173.115.94
country_id: 690791
description:
[2025-11-21 17:16:07 +0530] info [cpaneld] 185.173.115.94 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.133.77.89
country_id: 1733045
description:
[2025-11-21 17:16:10 +0530] info [whostmgrd] 115.133.77.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.229.186
country_id: 1269750
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 106.222.229.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.237.42.17
country_id: 1605651
description:
[2025-11-21 17:16:17 +0530] info [cpaneld] 49.237.42.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.213.48.162
country_id: 192950
description:
[2025-11-21 17:16:20 +0530] info [cpaneld] 102.213.48.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.181.13.212
country_id: 2635167
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 86.181.13.212 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.231.192.83
country_id: 298795
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 94.231.192.83 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.163.103.209
country_id: 1643084
description:
[2025-11-21 17:16:09 +0530] info [whostmgrd] 103.163.103.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:16:53 host2 sshd[2509728]: Disconnected from invalid user pivpn 172.172.130.40 port 55824 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.68.128
country_id: 3895114
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 179.60.68.128 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.71.140
country_id: 3865483
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 181.46.71.140 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.26.247.124
country_id: 1210997
description:
[2025-11-21 17:16:09 +0530] info [cpaneld] 103.26.247.124 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.104.212.145
country_id: 1562822
description:
[2025-11-21 17:16:08 +0530] info [cpaneld] 116.104.212.145 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.52.67.70
country_id: 1694008
description:
[2025-11-21 17:16:14 +0530] info [cpaneld] 122.52.67.70 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.49.233.135
country_id: 6252001
description:
[2025-11-21 17:16:16 +0530] info [cpaneld] 173.49.233.135 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.172.130.40
country_id: 6252001
description:
Nov 21 17:18:14 host2 sshd[2510680]: Disconnected from invalid user wanghao 172.172.130.40 port 38758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:18:23 host2 sshd[2510767]: Disconnected from invalid user manjaro 89.97.218.142 port 34258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.154
country_id: 1643084
description:
Nov 21 17:18:51 host2 sshd[2510961]: Disconnected from invalid user mostafa 182.8.228.154 port 21033 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 17:19:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<BcFkZxlE+utnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 17:20:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DZHJaxlEQOUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 17:20:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<zWllbBlEttNnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 17:21:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<NoMBcBlEsqFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 17:21:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<r13VbRlEHow+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 17:23:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cVkLdhlEZswXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 17:24:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<MWKXeBlEVJo5gL/H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 17:25:33 host2 sshd[2515870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:25:54 host2 sshd[2516038]: Disconnected from invalid user ubuntu 89.97.218.142 port 34382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 17:26:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<rO2dgRlEhyovWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 17:28:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61414: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:28:29 host2 sshd[2517534]: Disconnected from invalid user test01 43.133.254.75 port 42454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:29:14 host2 sshd[2517957]: Disconnected from invalid user ali 198.23.143.193 port 38964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 17:30:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<IfB+kBlE9NJn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:31:22 host2 sshd[2519446]: Disconnected from invalid user yuli 43.133.254.75 port 41672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:31:37 host2 sshd[2519609]: Disconnected from invalid user dell 102.88.137.80 port 1087 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 21 17:31:42 host2 sshd[2519690]: Disconnected from invalid user hung 89.97.218.142 port 34460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:31:44 host2 sshd[2519722]: Disconnected from invalid user roott 198.23.143.193 port 43356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:34:03 host2 sshd[2521159]: Disconnected from invalid user localhost 198.23.143.193 port 47744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:34:34 host2 sshd[2521455]: Disconnected from invalid user sharing 102.88.137.80 port 1087 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 17:35:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<+FUgohlEKriUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-21 17:36:28 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:60868: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Nov 21 17:36:38 host2 sshd[2522990]: Disconnected from invalid user arash 43.133.254.75 port 40104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-21 17:36:56 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:45772: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 17:37:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XYZwqBlEYJQrmxBp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov 21 17:39:04 host2 sshd[2524441]: Disconnected from invalid user lab 198.23.143.193 port 56524 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 17:42:49 host2 sshd[2527049]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-11-21 17:43:28 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:38664: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:43:33 host2 sshd[2527458]: Disconnected from invalid user testuser 102.88.137.80 port 1525 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-21 17:43:45 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:56100: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 17:44:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YcKEwBlEhMZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 17:44:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<xuA7wRlESqlz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 17:45:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<4U7TwxlEGgsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 17:45:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<dlUCxRlEoO0+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.95.81.217
country_id: 1269750
description:
2025-11-21 17:46:20 dovecot_plain authenticator failed for (Q171B58071) [103.95.81.217]:13775: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Nov 21 17:46:36 host2 sshd[2529943]: Disconnected from invalid user dell 102.88.137.80 port 33305 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 17:48:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<9N4UzhlEfIekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 17:49:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<A2Mm0hlEVqGYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.120
country_id: 3469034
description:
Nov 21 17:51:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.8.251.120, lip=66.85.158.91, TLS, session=<IYgv2hlE+9KxCPt4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.87.137
country_id: 3469034
description:
Nov 21 17:52:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=131.196.87.137, lip=66.85.158.91, TLS, session=<JVhh2xlERK6DxFeJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 17:52:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<lewd3xlERKlo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 17:55:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<uJ6t5xlEYIuElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 17:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<SUsU7xlE6slnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 17:57:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<rZAB7xlEanGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:00:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<GGCl+RlE4A8v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:00:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<QXp5+xlEkKCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 18:01:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7odP/RlE1seWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:01:44 host2 sshd[2544505]: Disconnected from invalid user admin 41.216.181.21 port 45140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:03:10 host2 sshd[2546060]: Disconnected from invalid user dmdba 200.46.125.168 port 39596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 18:03:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<YXZeBRpEuNln9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 18:05:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<xXUACxpE1J0+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 18:05:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ljWdCxpE0tal6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:05:45 host2 sshd[2548844]: Disconnected from invalid user ubuntu 41.216.181.21 port 33940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:07:00 host2 sshd[2549993]: Disconnected from invalid user ubuntu 41.216.181.21 port 34022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 18:06:26 host2 sshd[2549462]: Disconnected from invalid user grady 62.60.131.157 port 46700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 18:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ELfRERpEq0Zniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 18:07:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ds/MExpERud2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:07:27 host2 sshd[2550453]: Disconnected from invalid user es 200.46.125.168 port 54122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.181.21
country_id: 2750405
description:
Nov 21 18:09:22 host2 sshd[2552088]: Disconnected from invalid user user 41.216.181.21 port 34184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:09:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XoFGHBpEhrormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 18:10:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<uoDrHxpEZBMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 18:11:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<TgteIhpETqc+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:14:10 host2 sshd[2556436]: Disconnected from invalid user ajay 200.46.125.168 port 39754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 18:14:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<3xH+KxpE0uFz8UML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.64.202
country_id: 149590
description:
2025-11-21 18:15:35 dovecot_plain authenticator failed for (X58MAJ152S6) [41.59.64.202]:56038: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-21 18:16:59 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (sesism) [24.1.200.187]:35488: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.46.125.168
country_id: 3703430
description:
Nov 21 18:16:54 host2 sshd[2558806]: Disconnected from invalid user devil 200.46.125.168 port 44349 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 18:17:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<9oYzNhpEsshAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 18:17:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JIuVOBpE8LBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 18:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<hqs5RBpE9qVnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 18:21:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<0+abRRpEluBn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 18:22:26 host2 sshd[2562783]: Disconnected from invalid user grady 62.60.131.157 port 53951 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 18:23:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<+nZjTBpEPLQ5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 18:25:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<qG7uUhpEHrWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:26:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<AMlyWBpE8tErmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 18:28:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<063zXBpEWOM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 18:28:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<nV56XRpEBOJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:33:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<X5PocRpEjDgv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 18:33:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eDDscRpE3MtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 18:34:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<aavmdBpElOiYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-21 18:34:52 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:36734: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 18:34:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ooXydBpEjsqkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-21 18:35:07 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53294: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 18:37:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<//93fhpEJNho7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:39:07 host2 sshd[2574481]: Disconnected from invalid user zhangke 181.123.136.11 port 40850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:39:56 host2 sshd[2574953]: Disconnected from invalid user ftp_user 45.78.193.174 port 49328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:40:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<bFijiRpEApmElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:42:39 host2 sshd[2577024]: Disconnected from invalid user oracle 45.78.193.174 port 52054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 18:44:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<BClqlxpEFGCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 18:45:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<4pd1nBpEyqeElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 18:46:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<ki6znRpEUpM+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 18:46:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Y74lnhpEfJNz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:48:03 host2 sshd[2581063]: Disconnected from invalid user finn 45.78.193.174 port 55746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 18:48:24 host2 sshd[2581327]: Disconnected from invalid user newuser 201.217.12.57 port 60750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 18:48:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<NLGBphpEsDsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 18:51:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<j7iDrxpEdp6WXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:50:17 host2 sshd[2582607]: Disconnected from invalid user admin1 181.123.136.11 port 45206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 18:51:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<FiNxshpE5NZn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 18:52:03 host2 sshd[2583833]: Disconnected from invalid user random 201.217.12.57 port 49374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 18:52:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<Kwy+sxpE+NdAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 18:52:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<my42tRpEGJCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 18:55:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mQOvvRpERPMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:55:53 host2 sshd[2586914]: Disconnected from invalid user administrator 181.123.136.11 port 49130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.174
country_id: 1880251
description:
Nov 21 18:56:07 host2 sshd[2587089]: Disconnected from invalid user bitwarden 45.78.193.174 port 44478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 18:56:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tDQYxBpELxRniu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 18:57:21 host2 sshd[2587985]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.123.136.11
country_id: 3437598
description:
Nov 21 18:57:42 host2 sshd[2588181]: Disconnected from invalid user soporte 181.123.136.11 port 55910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 18:58:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<hPKCyhpEesw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 18:59:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<5hPFyxpEZsB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 18:59:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<GI6QzBpE3IJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 18:59:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iDa2zBpEkMArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 19:05:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<rIKz4xpEqNdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-21 19:05:54 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:46055: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-11-21 19:06:31 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:48262: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 19:08:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<tTiu7BpEssBnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-11-21 19:10:09 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (unhaffic) [98.192.74.183]:37818: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Nov 21 19:10:28 host2 sshd[2597275]: Disconnected from invalid user ftp_user 201.217.12.57 port 35994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 19:11:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<y/la9xpEJIBn76Vy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 19:14:43 host2 sshd[2600493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 19:15:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<UPMKBRtEWpFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 19:16:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iacqCRtEHsYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 19:20:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<mIIAGBtEvNI5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 19:20:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<jz63GBtEst2YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 19:20:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<JzUkGhtETrakXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 21 19:21:34 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<i+GNHBtElo258uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 19:21:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<jL5/HRtEVJVo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 19:22:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qElFHhtEuppA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 19:22:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<G2n9HhtEKLIv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Nov 21 19:22:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.91, TLS: Connection closed, session=<InK5HxtE/s7HLZqT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:23:57 host2 sshd[2605686]: Disconnected from invalid user postgres 103.144.146.186 port 55392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 19:24:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<CJryJxtE8IOElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:25:41 host2 sshd[2606838]: Disconnected from invalid user martina 103.144.146.186 port 40825 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 21 19:26:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<v3wLLxtEBsC58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 19:28:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<3e6UNRtE/seSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 19:29:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<GqiNOhtEbI+ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 19:30:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<84zWOhtELI1nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 21 19:29:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<NJC4OBtE1LY+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 19:29:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<pQtxOhtEaus+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-21 19:30:46 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (saing) [73.68.220.15]:43648: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 19:31:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<W4RFPhtE7LKnYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.146.186
country_id: 1643084
description:
Nov 21 19:32:11 host2 sshd[2610539]: Disconnected from invalid user user2 103.144.146.186 port 39006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 19:33:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ix41RxtEgu0+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-21 19:36:03 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:49152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-11-21 19:35:34 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:43542: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 19:37:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<4kWuUxtEvGsv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 19:39:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<VNjkXBtEW9ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 19:40:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pZ5bXxtENIGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 19:40:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<LbQ9XxtEqoBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 19:41:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2j0iYxtEPp2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.221.141.255
country_id: 1269750
description:
Nov 21 19:42:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=117.221.141.255, lip=66.85.158.91, TLS, session=<bNPRZxtEZ6t13Y3/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.89.94.7
country_id: 192950
description:
Nov 21 19:42:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=41.89.94.7, lip=66.85.158.91, session=<hKKDZxtEQo8pWV4H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 19:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<2fkEbBtE1sZz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:47 host2 sshd[2619212]: Disconnecting invalid user admin 176.235.182.73 port 54383: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:45:48 host2 sshd[2619229]: Disconnected from invalid user jenny1 190.111.211.81 port 32802 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:35 host2 sshd[2619094]: Disconnecting authenticating user root 176.235.182.73 port 50471: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Nov 21 19:45:35 host2 sshd[2619094]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 50471 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 19:47:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xNjFdxtEFCxniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.220.177
country_id: 2921044
description:
Nov 21 19:47:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.220.177, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7B9NeBtEH1VEt9yx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 21 19:47:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.227.134.101, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VvtmehtEmHSl44Zl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 19:48:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<dddlfRtESp0rmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:50:24 host2 sshd[2622120]: Disconnected from invalid user shree 190.111.211.81 port 39490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 19:50:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<RaphhRtEErt2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.4
country_id: 6252001
description:
Nov 21 19:51:28 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=203.55.131.4, lip=66.85.158.91, TLS, session=<xrmDhxtEhubLN4ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 21 19:51:55 host2 sshd[2622809]: Disconnected from invalid user admin 190.111.211.81 port 47456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.130.197.3
country_id: 798544
description:
Nov 21 19:53:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=195.130.197.3, lip=66.85.158.91, TLS, session=<66fAjRtEG6HDgsUD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 19:53:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<O4XjjhtEwLpnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 19:53:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<5nonjxtEqtM+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.235
country_id: 953987
description:
Nov 21 19:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.63.235, lip=66.85.158.91, TLS, session=<x4LijhtEEoFmgT/r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.234.137.17
country_id: 3175395
description:
Nov 21 19:55:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.234.137.17, lip=66.85.158.91, TLS, session=<STWrkxtEh8Zt6okR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 19:55:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<9Jp6lRtEDrxnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.191
country_id: 1269750
description:
Nov 21 19:55:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=103.84.202.191, lip=66.85.158.91, TLS, session=<wRXGlBtE47RnVMq/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 21 19:57:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.208.45, lip=66.85.158.91, session=<qpevmxtEwtSUcdAt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-21 19:58:12 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:54033: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-21 19:58:44 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:43380: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-21 19:59:04 dovecot_plain authenticator failed for (natord) [102.53.15.17]:40512: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 19:59:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<xccIpRtEMpA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 20:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<tcm7pxtE6M1nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 20:00:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<7XMnqBtE2o1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 20:00:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<soAEqRtE0o+UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 20:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<PTBmqRtEpMQ+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:05:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<LFsOuhtE3qkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 20:06:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<LgKeuxtEOp+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 20:06:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<RA3XvBtEeKho7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 20:07:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OjpfwBtEJoSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 20:07:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<xXiNwBtEIKdAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:09:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<j2LuxxtELuKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 21 20:10:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ECQ8yxtEooM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 20:10:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cRWlyxtEAKBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:11:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<FU1jzhtEspMv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 20:11:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<mwtnzxtEuLI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:12:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<FWDQ0BtEvtlz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 20:12:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<g8Zn0RtErpI+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-21 20:12:23 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (garnize) [5.185.198.73]:43100: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:14:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<oADB2htEgoGElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 21 20:16:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<P+le4htEnaZBMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 20:16:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ELvO3xtEVps+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 21 20:17:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2liM4xtEHPJBMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 20:17:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<6DOK4xtE0hSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 20:17:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<28FR4xtE+oU5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.167.38
country_id: 3469034
description:
Nov 21 20:23:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.109.167.38, lip=66.85.158.91, TLS, session=<m11w+BtEvL27bacm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.81
country_id: 3469034
description:
Nov 21 20:23:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.137.81, lip=66.85.158.91, TLS, session=<O8um+RtE+KW+WYlR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 21 20:25:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<Rzlx/xtEAJk+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 20:26:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<Pp0KAxxEkpI+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 20:27:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<P1BECRxEaJ0+PIOK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-11-21 20:28:36 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:57474: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 21 20:28:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<o2GCDBxEbLUjygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-21 20:29:06 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:59806: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 20:31:05 host2 sshd[2649055]: Disconnected from invalid user belen 62.60.131.157 port 15440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Nov 21 20:31:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, session=<2kbfFhxEQtDLN4MF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 20:32:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<A2zXGRxEiMI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.206
country_id: 6252001
description:
Nov 21 20:34:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<O2htIBxE7TlAPsXO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Nov 21 20:34:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wHyAIRxEZjFAPsXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 20:34:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<nodJIhxESOdo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 20:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<r8ZbIxxEJK4+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 20:36:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<32uFJxxEKJVnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 20:36:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<aVqCKBxEFOikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 20:36:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<WID7KBxEXsyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 20:39:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<ByCwMhxEJuJn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:41:07 host2 sshd[2655427]: Disconnected from invalid user vincent 198.46.249.175 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:42:18 host2 sshd[2656044]: Disconnected from invalid user steam 187.62.87.27 port 51160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 20:42:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ehRRPxxEJNaElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:42:58 host2 sshd[2656334]: Disconnected from invalid user vincent 161.132.50.86 port 48580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 20:43:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<X1gcQBxE3toI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:43:29 host2 sshd[2656581]: Disconnected from invalid user wms 103.154.216.188 port 52008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:43:35 host2 sshd[2656620]: Disconnected from invalid user uat 198.46.249.175 port 35386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 20:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<7yOfQhxERlqnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:44:03 host2 sshd[2656910]: Disconnected from invalid user acct 51.222.206.109 port 54716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:44:45 host2 sshd[2657380]: Disconnected from invalid user postgres 198.46.249.175 port 60908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:44:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ia8fRhxEeJBz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 20:46:42 host2 sshd[2659943]: Disconnected from invalid user belen 62.60.131.157 port 47425 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:47:11 host2 sshd[2660370]: Disconnected from invalid user uat 103.100.211.35 port 58160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:47:43 host2 sshd[2660585]: Disconnected from invalid user nexus 103.154.216.188 port 48846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 20:47:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<h9sbURxE9JRnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:48:52 host2 sshd[2661246]: Disconnected from invalid user josh 187.62.87.27 port 46212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:48:15 host2 sshd[2660924]: Disconnected from invalid user testuser 198.46.249.175 port 35116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.216.188
country_id: 1643084
description:
Nov 21 20:49:10 host2 sshd[2661425]: Disconnected from invalid user josh 103.154.216.188 port 47790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:49:26 host2 sshd[2661670]: Disconnected from invalid user admin 161.132.50.86 port 36216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 21 20:49:34 host2 sshd[2661741]: Disconnected from invalid user whatever 198.46.249.175 port 43190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 20:49:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<nMDfVxxEpoFz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:50:25 host2 sshd[2662350]: Disconnected from invalid user testuser 51.222.206.109 port 36990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:50:30 host2 sshd[2662374]: Disconnected from invalid user acct 187.62.87.27 port 57610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:50:39 host2 sshd[2662423]: Disconnected from invalid user postgres 103.100.211.35 port 40104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:50:42 host2 sshd[2662469]: Disconnected from invalid user amir 161.132.50.86 port 46118 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Nov 21 20:51:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<K/CxXBxEWitBMQGO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 20:51:59 host2 sshd[2663338]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Nov 21 20:51:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vHcWXRxEZCS4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Nov 21 20:51:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YHbDXRxEwEJBMQGO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 21 20:51:39 host2 sshd[2663023]: Disconnected from invalid user milad 51.222.206.109 port 39330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.55.113
country_id: 3469034
description:
Nov 21 20:52:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.82.55.113, lip=66.85.158.91, TLS, session=<261JXxxEObyqUjdx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.86
country_id: 3932488
description:
Nov 21 20:51:55 host2 sshd[2663250]: Disconnected from invalid user tester 161.132.50.86 port 51674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:53:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<2HvIYxxEUGEv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.193
country_id: 3469034
description:
Nov 21 20:52:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.193, lip=66.85.158.91, TLS, session=<0UiJYBxECbexLGDB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 20:53:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ayw8ZBxEfKc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.80
country_id: 99237
description:
Nov 21 20:53:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=65.20.129.80, lip=66.85.158.91, TLS, session=<hOqNZBxEPNlBFIFQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 20:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<0C+QZBxE3jcv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.222
country_id: 6252001
description:
Nov 21 20:53:46 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.222, lip=66.85.158.92, session=<5EhKZhxEquqTuYXe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 21 20:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Xz2hZhxEbsKl6Er8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.239.241.49
country_id: 3175395
description:
Nov 21 20:53:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=109.239.241.49, lip=66.85.158.91, TLS, session=<EbOgZRxEeuht7/Ex>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.255.211
country_id: 2921044
description:
Nov 21 20:53:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.255.211, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<IK2EZBxED2GG0f/T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:54:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<WCtFaRxEjKsrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:55:58 host2 sshd[2666692]: Disconnected from invalid user testuser 103.100.211.35 port 59220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 20:57:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<YsDbcRxEfstAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 20:56:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<AxmUbhxE3NQrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Nov 21 20:57:16 host2 sshd[2667530]: Disconnected from invalid user milad 187.62.87.27 port 49126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.211.35
country_id: 1819730
description:
Nov 21 20:57:45 host2 sshd[2667808]: Disconnected from invalid user iot 103.100.211.35 port 59464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 21:01:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<zIoVgBxEsJGYNbyQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.11.169
country_id: 597427
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 141.98.11.169 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 21:02:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<xgt7hRxE6pcXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.11.169
country_id: 597427
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 141.98.11.169 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 21:04:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<yN3cjRxE/r6l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-21 21:05:30 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:57504: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-21 21:05:43 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:50172: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 21 21:06:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<z7q4lBxEyp64affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 21:06:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<uNQPlRxEZJ1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 21:06:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<T/oPlRxEZNp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 21 21:07:13 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<kx9ulhxEjj64affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 21:07:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<oLLKlxxEaoU+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 21:08:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<0CBGmRxEoNdnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 21:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<aAfJmxxECKI+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 21:08:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ogYCnBxEuo+UcQQF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 21:09:16 host2 sshd[2675543]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 21:09:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<BPPcnxxEbApniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:10:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<RyqfoBxEloKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 21:11:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Cb+KpBxEwiwvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 21:13:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<U56QqxxEJu5o7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 21:14:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<xxUasRxEKug5gL/H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 21:15:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54645: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 21:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<ImY3thxE3ppnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:17:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<opmOuxxEDotz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 21:17:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<jUqvvBxExJEI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:18:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<8TncvxxEDuyTuYUq>


