# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-21 21:18:51 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:58942: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:19:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 97 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Al3SwRxEPN2TuYUq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 21:19:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<TCnEwBxEJOWkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2025-11-21 21:19:09 dovecot_login authenticator failed for ([49.124.159.186]) [49.124.159.186]:59902: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.184.10
country_id: 732800
description:
Nov 21 21:21:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=77.76.184.10, lip=66.85.158.91, TLS, session=<BxfkyRxEBcVNTLgK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:21:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<EhsOyBxELpCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 21:21:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<iHHbyBxEptU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 21 21:21:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<nMIHyhxEjo4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 21:22:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<6fJqyxxEjJ1nmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-21 21:21:14 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:35460: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-21 21:21:28 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:33218: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.72
country_id: 953987
description:
Nov 21 21:22:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.72, lip=66.85.158.91, TLS, session=<iDMIyxxEa6tmgTlI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 21:22:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<z17LzBxEJMuWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.42
country_id: 6252001
description:
Nov 21 21:25:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.42, lip=66.85.158.91, TLS, session=<NUUe1hxEeu6TuYUq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-21 21:26:26 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11994: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:26:53 host2 sshd[2686273]: Disconnected from invalid user dockeruser 24.232.50.5 port 33038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 21:27:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<JDIS3RxEGtRn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 21:27:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<RfiY3RxEAK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 21:27:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<o6EM4BxE7MenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 21:30:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<uF8n6xxElJoI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:31:55 host2 sshd[2689541]: Disconnected from invalid user bot 24.232.50.5 port 42326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:33:33 host2 sshd[2690756]: Disconnected from invalid user joel 24.232.50.5 port 35834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.45
country_id: 3865483
description:
Nov 21 21:33:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.89.45, lip=66.85.158.91, TLS, session=</nZG9BxE3bi+tVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.108
country_id: 3175395
description:
Nov 21 21:34:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.68.179.108, lip=66.85.158.91, TLS, session=<fleH9RxE2L+5RLNs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 21:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<NLpH+xxE6Lsv7YNh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:35:14 host2 sshd[2691979]: Disconnected from invalid user ubuntu 24.232.50.5 port 59996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 21:36:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<3Ifn/RxE0J8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.148
country_id: 3469034
description:
Nov 21 21:38:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.209.249.148, lip=66.85.158.91, TLS, session=<wTHrBR1EmYq60fmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.209
country_id: 3469034
description:
Nov 21 21:39:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=190.89.136.209, lip=66.85.158.91, TLS, session=<qw6BCB1ER7++WYjR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.232.50.5
country_id: 3865483
description:
Nov 21 21:40:03 host2 sshd[2698149]: Disconnected from invalid user felix 24.232.50.5 port 57838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:40:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<KqFeDR1ErsNz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 21:41:36 host2 sshd[2709414]: Disconnected from invalid user jana 62.60.131.157 port 56023 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 21:42:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<K5zqEx1EpqQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 21:43:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<2wS+GB1EeIuYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 21 21:43:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<mdO4GB1ExLk+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 21 21:43:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tpYOGR1EBAil6Er8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 21:43:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iwsoGR1E4LYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 21:44:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<p1zsGR1EesNnOJRs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.130
country_id: 6252001
description:
Nov 21 21:45:06 host2 pure-ftpd[2712405]: (?@198.235.24.130) [INFO] New connection from 198.235.24.130


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 21:45:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ucFCIB1E/qxz8UML>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.188.44
country_id: 2802361
description:
Nov 21 21:47:40 host2 pure-ftpd[2714569]: (?@34.140.188.44) [INFO] New connection from 34.140.188.44


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 21:48:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=</IbCKh1ExLql6LP6>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2025-11-21 21:49:07 1vMTqk-0000000BOJ0-0bSr <= choulwon.kim@kunhwamc.com H=(mail0.puellarium.com) [155.94.193.182]:33969 P=esmtps X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no S=10121 id=20251121111824.63FE37820166CC7E@kunhwamc.com T="Authentication error in info@ceylondigest.com on 11/21/2025 11:18:24 a.m." for info@ceylondigest.com


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 21:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<1JokLB1EarFAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:50:03 host2 sshd[2716306]: Disconnected from invalid user pz 164.92.106.89 port 34706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 21:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<fYctMR1Eyt6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 21:52:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<8TPmNh1ExrAFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 21:52:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<GJmPOB1ELKtn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 21:52:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<I3FdOR1EnRQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 21:54:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<dzahPR1EBIp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.206
country_id: 690791
description:
Nov 21 21:54:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=37.221.147.206, lip=66.85.158.91, TLS, session=<YITcPB1Eqp8l3ZPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Nov 21 21:53:20 host2 sshd[2718474]: Disconnected from invalid user vin 179.33.210.213 port 36992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 21:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<yhBrOx1EGORnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:53:42 host2 sshd[2718757]: Disconnected from invalid user joel 164.92.106.89 port 45332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.226
country_id: 953987
description:
Nov 21 21:53:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=102.129.56.226, lip=66.85.158.91, TLS, session=<eVCUOx1EStZmgTji>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 21:54:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<D7XwPx1ENMGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 21:54:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<y6uXQB1EULpo7CMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:54:51 host2 sshd[2720314]: Disconnected from invalid user kibana 164.92.106.89 port 56706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 21:56:57 host2 sshd[2721836]: Disconnected from invalid user jana 62.60.131.157 port 58207 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-21 21:57:01 dovecot_plain authenticator failed for (buffint) [178.250.191.189]:44556: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 21:56:17 host2 sshd[2721448]: Disconnected from invalid user deploy 95.0.252.5 port 34696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 21:57:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XMj6Sh1EzAVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 21:58:52 host2 sshd[2723071]: Disconnected from invalid user runner 95.0.252.5 port 39910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 21 21:59:17 host2 sshd[2723319]: Disconnected from invalid user ram 164.92.106.89 port 38932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Nov 21 22:00:11 host2 sshd[2724088]: Disconnected from invalid user admin 179.33.210.213 port 50484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 22:01:25 host2 sshd[2724870]: Disconnected from invalid user payment 95.0.252.5 port 57146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 21 22:02:57 host2 pure-ftpd[2725733]: (?@198.235.24.207) [INFO] New connection from 198.235.24.207


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 22:02:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<fgQrWx1ECs+kXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 21 22:02:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: read(size=713) failed: Connection reset by peer, session=<LhdbWx1EcutChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ImhAXB1EaJuElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Nov 21 22:02:42 host2 sshd[2725615]: Disconnected from invalid user admin 95.0.252.5 port 41342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.196
country_id: 6252001
description:
Nov 21 22:04:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.196, lip=66.85.158.92, session=<qJGuYR1E/atAPpzE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:04:11 host2 sshd[2726862]: Disconnected from invalid user rke 103.226.139.207 port 52688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 21 22:04:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<na5PYh1EdoZAPpzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 21 22:05:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Z/wmZR1EZrI+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 22:05:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<rmS4Zx1EhMhnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:07:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<O1XmbR1EwL8I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 22:07:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<TgQ4bx1EEuk5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:08:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<5nTdch1EYK9z8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 22:09:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<p1shdh1EdvanYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:09:32 host2 sshd[2730325]: Disconnected from invalid user firewall 103.226.139.207 port 40404 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.152
country_id: 6252001
description:
Nov 21 22:09:39 host2 pure-ftpd[2730420]: (?@64.62.197.152) [INFO] New connection from 64.62.197.152


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 21 22:09:45 host2 sshd[2730451]: Disconnected from invalid user webuser 123.58.212.64 port 46990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.207
country_id: 1643084
description:
Nov 21 22:10:56 host2 sshd[2731740]: Disconnected from invalid user move 103.226.139.207 port 35540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 22:10:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ete+dx1EktGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 22:10:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<NRsbeB1EIrNnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 22:13:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<bcj2hB1EvqM+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:13:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<fgoOhR1EtMxz8UML>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 21 22:14:23 host2 sshd[2733859]: Disconnected from invalid user myuser 123.58.212.64 port 34800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:16:00 host2 sshd[2734841]: Disconnected from invalid user joao 192.227.128.3 port 44984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 22:16:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<xBeIjR1EROlAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 22:21:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<fzkhoR1EDuVn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-21 22:22:00 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37064: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 22:21:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<GYyKnh1EbpYv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:21:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<yoUrnx1ErsgI3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-21 22:22:28 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:38432: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 22:23:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<WEVMph1E5u2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-21 22:26:44 dovecot_plain authenticator failed for (flophotity) [12.150.243.22]:39681: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.23.239.149
country_id: 6252001
description:
Nov 21 22:26:48 host2 pure-ftpd[2742480]: (?@52.23.239.149) [INFO] New connection from 52.23.239.149


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:31:04 host2 sshd[2745418]: Disconnected from invalid user yuriy 192.227.128.3 port 49372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 21 22:30:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<76D3vh1EiuM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 22:30:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<yE5mvx1EZr4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 22:31:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<KjCmxB1ErtgrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:32:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<88UNyB1EKpSElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 21 22:32:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qjOuyB1EPqI+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-11-21 22:33:09 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:55150: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:33:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<XB/2yx1E6cai2JaC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.118
country_id: 1269750
description:
2025-11-21 22:34:34 dovecot_login authenticator failed for ([128.185.166.65]) [182.95.222.118]:38812: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:34:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OMsh0B1EguGi2JaC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 22:34:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GOnvzR1EGq+l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-21 22:35:27 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:60999: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 22:36:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hOyj1B1EmfcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 22:37:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Hc0v2R1EArln76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 22:37:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Uasa2h1E9MZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 22:37:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<3jtr2h1EqNpo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 22:37:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<ommM2B1ErMtz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:38:32 host2 sshd[2749609]: Disconnected from invalid user murad 192.227.128.3 port 42656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 22:39:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<KNUm3x1E0qJnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.128.3
country_id: 6252001
description:
Nov 21 22:40:24 host2 sshd[2750743]: Disconnected from invalid user daniel 192.227.128.3 port 45070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 22:41:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<gAN85h1E+us+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 22:41:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<SmMS5x1ERItAF4KF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.130
country_id: 6252001
description:
Nov 21 22:41:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.130, lip=66.85.158.92, TLS, session=<6dse6B1EwPai2JaC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 22:42:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QEFa6R1ECph2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 22:42:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<2K4j6h1ErK6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 22:44:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<s1pf8x1EasGElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 22:45:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<mUsu9R1E2LKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 22:45:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<crz79R1EoB1niu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 22:46:50 host2 sshd[2754974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 22:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<A3v0CB5EluxnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 22:51:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<qdSXDB5EwskXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 22:52:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ceb2Dh5EPk2nYwhf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 22:56:15 host2 sshd[2761882]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 21 22:55:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<1eWJGh5EYJk+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 22:57:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xk/fIR5EhoqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 22:58:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<Ec4jJR5EHu4I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 22:59:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ED0OKB5EjpM5gL/H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:00:23 host2 sshd[2764356]: Disconnected from invalid user ts3server 71.70.164.48 port 49470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.208
country_id: 6251999
description:
Nov 21 22:59:53 host2 sshd[2763911]: Disconnected from invalid user devuser 158.69.194.208 port 56233 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 21 23:01:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<RAxCLh5E4tNHBpKC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.208
country_id: 6251999
description:
Nov 21 23:02:03 host2 sshd[2765212]: Disconnected from invalid user monitor 158.69.194.208 port 54866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.97
country_id: 690791
description:
Nov 21 23:02:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.221.139.97, lip=66.85.158.91, TLS, session=<ixl/MB5E4rgl3Yth>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.79.251.53
country_id: 3469034
description:
Nov 21 23:01:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=170.79.251.53, lip=66.85.158.91, TLS, session=<ShenLh5Eh6OqT/s1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 23:04:02 host2 sshd[2767084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:03:57 host2 sshd[2766962]: Disconnected from invalid user autrede 71.70.164.48 port 50845 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:05:18 host2 sshd[2767749]: Disconnected from invalid user user 45.78.201.131 port 35008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 23:06:39 host2 sshd[2768768]: Disconnected from invalid user aja 62.60.131.157 port 29455 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 23:08:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<6RuXSB5ELtCYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 23:07:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<fINlRR5E0Asv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 23:08:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<+cbpSB5EeoVAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.50.35
country_id: 2963597
description:
Nov 21 23:10:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=37.203.50.35, lip=66.85.158.91, TLS, session=<GpcYTh5ELoklyzIj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:11:01 host2 sshd[2771413]: Disconnected from invalid user incoming 71.70.164.48 port 47122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.34
country_id: 3175395
description:
Nov 21 23:10:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=195.177.113.34, lip=66.85.158.91, TLS, session=<rD0nTx5EdqLDsXEi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 23:10:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<VV4hUB5EcKVnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-21 23:13:28 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:33530: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2025-11-21 23:13:15 dovecot_login authenticator failed for ([103.57.184.151]) [103.57.184.151]:34530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:15:25 host2 sshd[2773871]: Disconnected from invalid user activemq 152.32.172.161 port 59706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 23:16:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<8EYvZh5EKuyElIx5>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:32 host2 sshd[2775604]: Disconnecting authenticating user root 103.156.219.39 port 54495: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:32 host2 sshd[2775604]: error: maximum authentication attempts exceeded for root from 103.156.219.39 port 54495 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 23:18:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<DmhBbB5EhJpn9Sd0>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:43 host2 sshd[2775665]: Disconnecting authenticating user root 103.156.219.39 port 54575: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 103.156.219.39
country_id: 1643084
description:
Nov 21 23:18:43 host2 sshd[2775665]: error: maximum authentication attempts exceeded for root from 103.156.219.39 port 54575 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 21 23:20:16 host2 sshd[2776769]: Disconnected from invalid user kale 71.70.164.48 port 44268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 23:21:11 host2 sshd[2777486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 23:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<wmqwdh5EuICl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 23:20:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<f6FKdB5EXsYrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:21:05 host2 sshd[2777438]: Disconnected from invalid user vpn 152.32.172.161 port 54788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 23:22:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<mWu1eR5E4OormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 23:22:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<71wiex5EmOMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 23:23:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<Yu7EfB5EvIBo7CMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-21 23:23:25 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:47514: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-21 23:23:42 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:58252: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 21 23:23:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<OIJtfh5EUIs+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:23:54 host2 sshd[2779054]: Disconnected from invalid user mastodon 152.32.172.161 port 48424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Nov 21 23:25:14 host2 sshd[2779863]: Disconnected from invalid user ts3 152.32.172.161 port 33174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 23:26:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Sxrkhh5E2sZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 23:27:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<gYkEix5EtItnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 23:29:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<vTuclB5EysGElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 23:31:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<uiJvmR5EisZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 23:31:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<jjyemR5EyJ2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 23:32:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<jf1lnh5ECN6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 23:33:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<vcEZox5E4pVAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:34:20 host2 sshd[2786240]: Disconnected from invalid user emo 45.78.201.131 port 43790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.236
country_id: 2635167
description:
Nov 21 23:34:42 host2 pure-ftpd[2786560]: (?@87.236.176.236) [INFO] New connection from 87.236.176.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 23:36:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</nZhqx5E3Btniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.131
country_id: 1880251
description:
Nov 21 23:36:55 host2 sshd[2788830]: Disconnected from invalid user autrede 45.78.201.131 port 33454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 23:39:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<ss4Nth5EfOFnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 23:39:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iFCqth5EmnynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 23:41:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<CMGOvR5EHL9nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 23:46:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<b87rzx5E7o6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 23:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<UFom1R5ExoM+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 21 23:51:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Dz164B5EQqo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 23:54:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<sIDA7R5E+teYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 23:55:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<lC248R5E1ogv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.49
country_id: 3469034
description:
Nov 21 23:56:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=187.120.77.49, lip=66.85.158.91, TLS, session=<mUpB8h5Erpi7eE0x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.138.135
country_id: 99237
description:
Nov 21 23:56:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.138.135, lip=66.85.158.91, TLS, session=<Rp+V8x5EE5NBFIqH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 23:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<NyiL9h5ErKs5gL/H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.220
country_id: 6252001
description:
Nov 21 23:58:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.220, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6Qmn+R5EzszN0h/c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 21 23:59:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Bltt/R5E/OA+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 21 23:59:24 host2 sshd[2805440]: Disconnected from invalid user admin 2.57.121.112 port 58651 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.97.71
country_id: 6252001
description:
Nov 22 00:00:12 host2 pure-ftpd[2806280]: (?@135.119.97.71) [INFO] New connection from 135.119.97.71


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:01:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<fMbDBR9EkpdAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 00:00:45 host2 sshd[2806654]: Disconnected from invalid user saige 62.60.131.157 port 36624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:02:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<fSqbCB9EToWElIx5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.252
country_id: 6252001
description:
Nov 22 00:05:09 host2 pure-ftpd[2810053]: (?@45.79.207.252) [INFO] New connection from 45.79.207.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:05:48 host2 sshd[2810410]: Disconnected from invalid user gast 103.153.190.105 port 57256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-22 00:06:17 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:51810: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-22 00:06:43 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:40825: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 00:09:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<M67VIB9Ez84vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 00:09:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<G3jxIR9EkIxo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 00:10:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2E2+Jh9ElMQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 00:11:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oC7HKB9EaJel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 00:12:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<uCo9LB9EyOErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 00:13:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<1Kb9Lh9EkNZnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 22 00:12:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<y1sKLh9E5LuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 00:14:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<BZD9Mx9EkI5n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 00:15:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<YF3kNh9EuNRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:15:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<zlsNNx9E2MiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 00:15:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<t3GhNh9EkKpnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.137.127
country_id: 3144096
description:
2025-11-22 00:16:38 dovecot_login authenticator failed for (cm-178.232.137.127.get.no) [178.232.137.127]:52835: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-22 00:16:55 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49604: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.101
country_id: 798544
description:
Nov 22 00:18:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.97.101, lip=66.85.158.91, TLS, session=<cbFqQR9EF7Sy22Fl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 00:17:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<ItDePx9EnrmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.157
country_id: 3469034
description:
Nov 22 00:18:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.72.78.157, lip=66.85.158.91, TLS, session=<jmzxPx9ErqOxSE6d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 00:19:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<qF5VRB9EUsB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.176
country_id: 3469034
description:
Nov 22 00:20:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=177.44.96.176, lip=66.85.158.91, TLS, session=<gvEFSB9EJqCxLGCw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.51
country_id: 3277605
description:
Nov 22 00:19:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=188.246.73.51, lip=66.85.158.91, TLS, session=<Zh23RR9EM6W89kkz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 00:23:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=</wGRUx9EGp6UcQQF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:23:45 host2 sshd[2822864]: Disconnected from invalid user linda 103.153.190.105 port 59680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:25:16 host2 sshd[2824463]: Disconnected from invalid user admin 165.154.205.128 port 52590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:26:35 host2 sshd[2825548]: Disconnected from invalid user appuser 27.100.36.42 port 33936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 00:26:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<qx2SXx9EJgZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 00:26:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qerAXx9E6P2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:27:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<qPG6YR9EWstAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 00:27:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<S9K9Yx9EQMpnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:28:30 host2 sshd[2826776]: Disconnected from invalid user dinesh 103.153.190.105 port 51239 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.154.238
country_id: 1168579
description:
Nov 22 00:29:33 host2 sshd[2827491]: Disconnected from invalid user jay 121.52.154.238 port 49802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:29:41 host2 sshd[2827569]: Disconnected from invalid user jay 103.59.94.155 port 48392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:29:43 host2 sshd[2827638]: Disconnected from invalid user vinay 27.100.36.42 port 51454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:31:08 host2 sshd[2828709]: Disconnected from invalid user prowlarr 103.59.94.155 port 59250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:31:25 host2 sshd[2828905]: Disconnected from invalid user raja 27.100.36.42 port 52274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:30:53 host2 sshd[2828569]: Disconnected from invalid user eren 165.154.205.128 port 35124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:32:33 host2 sshd[2829761]: Disconnected from invalid user viewer 103.59.94.155 port 37782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 22 00:32:57 host2 sshd[2830031]: Disconnected from invalid user postgres 103.153.190.105 port 39196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:33:20 host2 sshd[2830321]: Disconnected from invalid user user9 27.100.36.42 port 53118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 22 00:33:48 host2 sshd[2830581]: Disconnected from invalid user Test 147.50.227.142 port 45722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 00:34:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gSzKfB9E8J8XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:35:04 host2 sshd[2831597]: Disconnected from invalid user devel 165.154.205.128 port 59786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.155
country_id: 1643084
description:
Nov 22 00:35:12 host2 sshd[2831765]: Disconnected from invalid user admin 103.59.94.155 port 50684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 00:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<f6uUfh9EFpyWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:36:22 host2 sshd[2832527]: Disconnected from invalid user vinay 165.154.205.128 port 53404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.100.36.42
country_id: 2077456
description:
Nov 22 00:38:00 host2 sshd[2833649]: Disconnected from invalid user danya 27.100.36.42 port 55614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Nov 22 00:39:04 host2 sshd[2834388]: Disconnected from invalid user steve 165.154.205.128 port 35256 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 00:39:39 host2 sshd[2834792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 22 00:41:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<kR3JlB9ErMuYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-22 00:41:41 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:51524: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-22 00:42:06 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:34174: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 22 00:44:03 host2 sshd[2837499]: Disconnected from invalid user alex 147.50.227.142 port 57024 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 22 00:44:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<W3eonh9EfF5ChJl6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.157
country_id: 6252001
description:
Nov 22 00:43:44 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.157, lip=66.85.158.91, session=<93HBnB9ELINC5DWd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 00:43:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<h4IDnR9EJNFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 00:44:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LGcioB9Evrk+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 22 00:44:56 host2 pure-ftpd[2838064]: (?@167.94.146.63) [INFO] New connection from 167.94.146.63


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 00:45:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<e5kqoR9EYM4v7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 00:47:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<ECWGqx9EEpWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.218
country_id: 99237
description:
Nov 22 00:48:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=65.20.153.218, lip=66.85.158.91, TLS, session=<UESoqx9EhcRBFJna>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.140
country_id: 690791
description:
Nov 22 00:47:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@casa18villa.com>, method=PLAIN, rip=176.103.7.140, lip=66.85.158.91, TLS, session=<CD1kqh9Ey9uwZweM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 00:55:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<f68sxR9E1MQ5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 00:55:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<V0g7xh9ESqpAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 00:55:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<yRqoxx9EmrovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 00:55:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<Rzy4xx9EarRo7CMU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 00:56:37 host2 sshd[2846195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 00:59:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<j7VK1B9ENo2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:01:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<oIaR2h9E2uMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:00:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<RiVN2h9EMteElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 01:03:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<fyCv4h9EkuZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:02:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<A1AM4B9EIOkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 01:04:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<spUl5h9EluJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 01:04:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<4oG55h9EkpU+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 01:04:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<wTGz5R9ESMSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 01:07:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<q2/Q8B9EaIp2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Nov 22 01:08:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=173.255.221.189, lip=66.85.158.91, session=<tBh/9B9E4bWt/929>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 01:08:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Y1ih9h9EqO1n9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 01:11:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 01:13:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<lVUYBiBE7MqUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 01:13:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<wIPoBiBEFO6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 01:14:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<PS8TDCBEsMpnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.87
country_id: 3469034
description:
Nov 22 01:16:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=187.120.72.87, lip=66.85.158.91, TLS, session=</c4DDyBEldu7eEhX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 01:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<AumRECBE0IZnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.70.38.61
country_id: 3865483
description:
Nov 22 01:16:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=146.70.38.61, lip=66.85.158.91, session=<idr2ECBEjTmSRiY9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.123
country_id: 2215636
description:
Nov 22 01:16:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=169.239.118.123, lip=66.85.158.91, TLS, session=<HrhFECBEQ9Cp73Z7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 01:16:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<cn04ESBEoR1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.126
country_id: 3469034
description:
Nov 22 01:17:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.120.73.126, lip=66.85.158.91, TLS, session=<mLHxFCBE++i7eEl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Nov 22 01:17:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<IlwqFiBEsLO5xQmz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 01:21:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<KagTIiBEcqJAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 01:24:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<H1GZLSBEtKSWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Nov 22 01:26:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.239, lip=66.85.158.92, session=<L/fjNiBEPPjN0h/v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 22 01:28:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<04sIPCBE6NOYNbyQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.79.181.157
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.79.181.157 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.81.172
country_id: 6252001
description:
Nov 22 01:32:26 host2 pure-ftpd[2872207]: (?@47.251.81.172) [INFO] New connection from 47.251.81.172


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:33:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<EBbGTSBEUoyElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 01:34:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<7g1yUiBEeswv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 22 01:34:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<8KljUyBECvkv7YNh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.102
country_id: 6252001
description:
Nov 22 01:37:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.36.102, lip=66.85.158.91, session=<JvlYXiBEromlmiRm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.36.102
country_id: 6252001
description:
Nov 22 01:37:53 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.36.102, lip=66.85.158.91, session=<pbJpXiBEPoqlmiRm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 01:40:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<vcqOaCBEIpU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 22 01:41:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<UCbFbCBEeaUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 01:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<U6fvbCBEJJ9o7CMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 01:42:04 host2 sshd[2879441]: Disconnected from invalid user admin 2.57.121.112 port 53861 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-22 01:44:01 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:34640: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-22 01:44:20 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:56935: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.216
country_id: 3175395
description:
Nov 22 01:45:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.234.216, lip=66.85.158.91, TLS, session=<y4EKeSBExZerFurY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.16.146.222
country_id: 1269750
description:
Nov 22 01:46:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.16.146.222, lip=66.85.158.91, TLS, session=<Py40eiBEXYlnEJLe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 01:46:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<bxF/eyBEhMhnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 01:46:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<gUH7eyBEusiElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 01:46:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<W/ajfiBE6N2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 01:49:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@colourmarklabels.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<ke4nhiBEur1AF4KF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-11-22 01:50:16 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:38178: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 22 01:50:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<gF50jCBEqM+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 01:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<xUeujCBEGOJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:51:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<E611jSBEWsIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 01:52:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<9z4AkyBENOsrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 01:52:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<R6MikyBEKLs5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 01:52:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<SOEskyBEFIJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 01:55:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<UaR4nCBESLh2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 01:57:00 host2 sshd[2891682]: Disconnected from invalid user davin 62.60.131.157 port 64755 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 01:57:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<75mtoyBE3uM+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.151
country_id: 3175395
description:
Nov 22 01:58:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=171.22.235.151, lip=66.85.158.91, TLS, session=<BFNdpSBEDeCrFuuX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 22 01:58:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<9j14piBEYa+ynG0e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 01:59:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<SmzCqyBEmLqnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 01:59:17 host2 sshd[2892965]: Disconnected from invalid user visitor 38.105.25.194 port 53136 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 02:00:31 host2 sshd[2893912]: Disconnected from invalid user zbx 38.105.25.194 port 45712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 02:02:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<1RvatyBE6s1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<uwLRuCBEVoGUcQQF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 22 02:03:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<tjTcuSBEHJFChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-22 02:04:34 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 22 02:03:37 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, session=<WTxtuiBErudChJl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:04:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<0bIhviBEmtw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 02:04:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<kSPkviBEQIpnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Nov 22 02:05:10 host2 sshd[2897067]: Disconnected from invalid user bogdan 38.105.25.194 port 55034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:06:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<NepkwyBE2jdniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.205
country_id: 6252001
description:
Nov 22 02:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.205, lip=66.85.158.91, session=<KaWh1iBEH9lomDTN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.203
country_id: 6252001
description:
Nov 22 02:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.203, lip=66.85.158.91, session=<iRqj1iBE1cJomDTL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.211
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.211, lip=66.85.158.91, session=<YovE1iBEt5ZomDTT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.207
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.207, lip=66.85.158.91, session=<p4vH1iBEP4domDTP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.209
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.209, lip=66.85.158.91, TLS: Connection closed, session=<lo3M1iBEmaBomDTR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.206
country_id: 6252001
description:
Nov 22 02:11:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.206, lip=66.85.158.91, session=<WvHI1iBEt79omDTO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.30
country_id: 1643084
description:
Nov 22 02:13:32 host2 sshd[2903284]: Invalid user cloudtourssrilan_travel from 182.8.225.30 port 62200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.30
country_id: 1643084
description:
[2025-11-22 02:13:33 +0530] info [whostmgrd] 182.8.225.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 22 02:14:59 host2 pure-ftpd[2904021]: (?@165.227.134.101) [INFO] New connection from 165.227.134.101


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.200.102
country_id: 2921044
description:
Nov 22 02:14:59 host2 pure-ftpd[2904018]: (?@164.92.200.102) [INFO] New connection from 164.92.200.102


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 02:24:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<76GNBiFEhp0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 02:27:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<e64fDyFEYLwXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.117
country_id: 6252001
description:
Nov 22 02:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.106.117, lip=66.85.158.91, session=<CP0OFCFE0sAUQGp1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:31:52 host2 sshd[2914284]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:32:22 host2 sshd[2914486]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 02:32:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<FNFVICFE2JOElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-22 02:33:11 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:53287: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 22 02:33:16 host2 sshd[2914934]: Invalid user visionsolutionshospital from 154.219.110.64 port 48064


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-22 02:33:24 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:40946: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 22 02:35:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<piHjKiFEfqiUcdZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:36:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1oLlLiFETrA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:36:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<F0gIMCFE4M4+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:39:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1PEJOSFEXIw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.49.251
country_id: 6252001
description:
Nov 22 02:38:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.49.251, lip=66.85.158.92, session=<3vrINSFEtKqsyjH7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Nov 22 02:38:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<27nlOCFEYtyTuYRY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 02:40:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<PbScPyFEMJE+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 02:43:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<sKazRyFESsg+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 02:44:54 host2 sshd[2921812]: Disconnected from invalid user admin 2.57.121.112 port 22784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:45:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TO7JTyFE9wRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 02:46:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TGr2USFE2uVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 02:48:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zJlUWSFEiuc+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 02:48:45 host2 sshd[2924558]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:48:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<aJNpWiFEPs2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 02:48:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<nF1CWyFEilKnrHj2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-22 02:48:45 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:43066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:48:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<blapWyFEMN8zTd4Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-22 02:48:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 02:48:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<J0xrWSFEbN1tbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 02:49:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<RXHIXyFEML/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 02:49:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DrMOXSFE5qorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:49:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<heZmXSFEGJozTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 02:49:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<gDyyXSFEQrA+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 02:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<fdOyXyFEqtto7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 02:50:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FRX5YiFESnRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.45
country_id: 3175395
description:
Nov 22 02:50:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.197.9.45, lip=66.85.158.91, TLS, session=<70+0YCFENp25xQkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.235
country_id: 798544
description:
Nov 22 02:50:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=178.219.105.235, lip=66.85.158.91, TLS, session=<GbrGYSFEEt2y22nr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 02:52:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KVlIaiFEqAZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 02:53:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<DMqdbCFEyq9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 02:56:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<MRmfdSFEEs+nrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 02:55:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<guj7cyFEeo9tbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 02:55:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<agrzdCFEZJSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 02:55:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1qxCdSFELOs+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 02:56:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<cwQgdiFEdNQzTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 02:56:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Ip+TdyFEUtArpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 02:57:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<VJFueiFEPtzIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 02:57:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<HNcneiFERMlo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 02:58:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kt9qfSFEwJ1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 02:59:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<qnafgyFE5wi2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.190
country_id: 6290252
description:
Nov 22 03:00:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=91.234.135.190, lip=66.85.158.91, TLS, session=<0ghehCFEOb5b6oe+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 03:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vXLGhSFEAteLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 22 03:00:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<ODMKhiFEjpwzTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.75
country_id: 732800
description:
Nov 22 03:00:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.212.75, lip=66.85.158.91, TLS, session=<hL12hSFEtt65/9RL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 03:00:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ArbThCFEauy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 22 03:01:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hWpAiiFEZpOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 03:01:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<kABgiiFEktenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 03:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qKYljSFEnrs+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 03:02:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<ZRmhjiFE5so+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 03:03:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<u614jyFEJOSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:04:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<+8lFkyFEyMUv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 03:05:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rQlklyFE/OfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 22 03:05:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HwcymCFEztAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 03:05:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<jB43mCFE4qk+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-11-22 03:05:54 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:59141: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 03:06:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<VVq6myFEhIov+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 03:06:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<Sm3emyFEdoVnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-22 03:06:50 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:45838: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 03:06:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<KSjjnCFEzqEzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 03:08:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<L8GqoCFE2oxrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 03:07:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yVgqnyFERocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:07:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<9ONvoCFEQpUv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 03:08:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<NghqoSFE2KMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 03:08:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<fuCdoiFEOpNn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 03:09:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<UNt8pyFEIrE+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 03:10:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<P/EnqSFEPLY+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 03:10:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<o/QhqyFE+tJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 03:12:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<pCHnriFEIMY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.43
country_id: 953987
description:
Nov 22 03:12:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.41.43, lip=66.85.158.91, TLS, session=<tmSosCFEn+lmQCkr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.158
country_id: 953987
description:
Nov 22 03:12:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.64.33.158, lip=66.85.158.91, TLS, session=<VQlNryFEsJVmQCGe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 22 03:14:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<rLQNtyFEvLwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 22 03:15:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<MA/IuyFEwt2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:16:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<KWkovSFEtrk+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 03:16:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<s1OfviFEqssI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Nov 22 03:16:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ayuzonelanka.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<l5rNviFEmte8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 22 03:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<3JtaxCFEQp9nmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-22 03:18:59 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:41880: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 03:19:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xuTWySFEJpsv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 03:20:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZG4RzSFEiwtniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:20:34 host2 sshd[2944706]: Disconnected from invalid user sftp_user 154.219.125.194 port 54750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 03:21:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<aLCB0SFE1p12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 22 03:21:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<qXLV0SFEAtKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 03:21:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<y5Jq0iFEdK4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 22 03:22:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Uo3G0iFEAsUv/DJe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:21:09 host2 sshd[2944954]: Disconnected from invalid user soporte 81.170.248.221 port 41636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:22:41 host2 sshd[2945791]: Disconnected from invalid user dspace 81.170.248.221 port 46184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.71
country_id: 6252001
description:
Nov 22 03:22:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kAb41SFEc8/N0h9H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 03:23:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<R57f1iFEINI+PIcd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 22 03:23:17 host2 pure-ftpd[2946094]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 22 03:23:20 host2 pure-ftpd[2946126]: (?@138.68.104.64) [INFO] New connection from 138.68.104.64


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:24:07 host2 sshd[2946554]: Disconnected from invalid user soporte 154.219.125.194 port 39782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 03:24:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<5Y2/2iFEcuOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 03:25:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<a79X3yFElqcv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:25:13 host2 sshd[2947430]: Disconnected from invalid user demo3 154.219.125.194 port 59556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 03:27:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<eW2/5CFE0LM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 03:26:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MtUg4iFEitYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 03:26:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<ty484yFEsJwv+yzS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 1819730
description:
Nov 22 03:27:25 host2 sshd[2949005]: Disconnected from invalid user p 154.219.125.194 port 41588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 03:27:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<gMuk5iFEOMov+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:28:03 host2 sshd[2949398]: Disconnected from invalid user ftpuser 162.241.87.197 port 55862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 03:27:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<TALl5CFEitpnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.146
country_id: 3175395
description:
Nov 22 03:28:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.169.146, lip=66.85.158.91, TLS, session=<IM/t5yFEBZ25D6mS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.219
country_id: 690791
description:
Nov 22 03:28:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.25.219, lip=66.85.158.91, TLS, session=<b6AD6SFEOuuwZxnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 03:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<WmKK6iFEht6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 22 03:29:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<10bS6yFEdtTBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 03:29:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<BM0j7SFEdtE+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 03:29:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GDvj7SFEbIJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 03:29:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<meAX7yFE9Mml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 03:29:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<uo0y7yFEEpmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-11-22 03:30:42 dovecot_login authenticator failed for (31-154-88-152.orange.net.il) [2.55.88.152]:52389: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Nov 22 03:30:49 host2 sshd[2951257]: Disconnected from invalid user admin 81.170.248.221 port 39328 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:30:16 host2 sshd[2950954]: Disconnected from invalid user soporte 162.241.87.197 port 51948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 22 03:32:28 host2 sshd[2952362]: Disconnected from invalid user scs 162.241.87.197 port 45548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 03:33:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<M48j+yFEOMAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 03:35:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<gkFnASJERO2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 03:34:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<0KK//yFEQJaUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 03:34:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<RLvT/yFEFKY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 03:34:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<CjTDACJEYNJnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 03:35:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<ElEUBCJEiIRtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 03:36:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<M6u0BSJEWIOElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 03:37:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<qoQuCiJE2Oo+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 03:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<vcvaCiJEaIk+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 03:39:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<uOpjDyJErp9n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 03:39:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<Y0B2DyJExDenrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:39:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<F9sVECJERpU+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 22 03:39:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mkZwECJEQKtm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 03:39:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<yVMzESJElpOUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 03:39:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZzVtEiJETtI+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 03:40:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<D/B8EyJE0K8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 03:40:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<9Bx/EyJEhstnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 03:40:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<fGIyFCJERieYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 03:40:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<PqY5FSJEnr4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 03:41:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<EKwHFyJESoEv+yXY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 22 03:41:21 host2 pure-ftpd[2958547]: (?@148.113.211.131) [INFO] New connection from 148.113.211.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 22 03:41:27 host2 pure-ftpd[2958610]: (?@148.113.211.131) [INFO] New connection from 148.113.211.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 22 03:41:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<bJ6fGSJE2NKB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 03:42:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+dyyHCJEWuJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 22 03:45:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<FLuOJiJENIM5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov 22 03:45:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<S2KuJiJEy8sz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 03:45:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<39VZKCJEvOg+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 03:46:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<aIBtKSJEopVtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 03:46:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<JYoqKyJEPNo+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 22 03:47:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<r0OPLCJEvsZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 03:48:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9rOLMSJENrII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 03:48:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</fsHMyJERRJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 03:49:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<kKxkNSJEuqgvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 03:49:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<M89aNiJEfpc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 03:51:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<zpN2OiJEZK6qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 03:51:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@agronatureholdings.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<TnsZOyJE8Yy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 03:52:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ffweQCJEyMKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 03:53:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<GkK7QSJEbsYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 03:54:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wC0gRyJEap52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 03:54:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<z2O6RyJEotYvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 03:56:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<JhekTiJEsLBAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 22 03:58:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<YB8sVSJERu4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 22 03:58:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<vqPmVSJEjIkv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 03:59:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+A4BWiJE+oY+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:00:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<6KsrXCJEDsgv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:01:24 host2 sshd[2977490]: Disconnected from invalid user admin 104.168.117.131 port 52260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:01:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<wq6LYSJEkodnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:02:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<yVxxYiJEuo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:02:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@agronatureholdings.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<10qWYyJE+pJrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:03:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@askinternationalconsortium.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<zlBbaCJEIrxrhr+5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:03:39 host2 sshd[2980013]: Disconnected from invalid user gpu 104.168.117.131 port 37566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:04:41 host2 sshd[2980772]: Disconnected from invalid user myuser 104.168.117.131 port 33124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 04:05:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<T5arbSJESHC2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 22 04:05:44 host2 sshd[2981975]: Disconnected from invalid user ir 104.168.117.131 port 58936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov 22 04:05:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Q6W3biJEbnG2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 22 04:07:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<DDmZcyJEdOIv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 22 04:06:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ayuzonelanka.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<SDC/cSJEipRrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:06:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<kSgTciJEJNg+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:06:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<MbuxciJEZKpnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:07:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<mpLMdSJEPoyl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.111.55.179
country_id: 3017382
description:
Nov 22 04:08:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=109.111.55.179, lip=66.85.158.91, session=<u6lIeSJETphtbzez>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 04:08:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<SOJleSJEzPKnrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 04:08:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VV8JeiJE0Jsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 04:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<MXkCfyJERsySO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 04:10:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<FO86gSJEasul0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Nov 22 04:11:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oBFtgiJEUMnN0h9p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.123
country_id: 3865483
description:
Nov 22 04:11:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=45.238.107.123, lip=66.85.158.91, TLS, session=<V4IBgyJET+Yt7mt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.105
country_id: 690791
description:
Nov 22 04:11:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=176.103.0.105, lip=66.85.158.91, TLS, session=<4wc7hCJEatiwZwBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 04:13:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<f3pGiSJESJg+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:13:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<oOJLiSJE/NJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-22 04:13:08 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38699: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:12:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eqaWhyJEWLM+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-22 04:12:47 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:53794: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 04:14:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JCbDjiJEVrFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 22 04:14:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<ppyCjyJEUo3Bl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-11-22 04:15:31 dovecot_login authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:65005: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 22 04:15:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<i3XYkiJEyt0v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-22 04:16:06 dovecot_login authenticator failed for (static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:31754: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 22 04:16:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<rO46liJEyrqElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-22 04:16:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:52208: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 04:16:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zhCxliJEYop2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-22 04:16:58 dovecot_plain authenticator failed for (paichist) [102.53.15.56]:42168: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Hp/2miJE6udnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 04:18:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Ox/imiJEPpeLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 22 04:18:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<rx7tnSJE6uGqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 04:18:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HQwpniJEeoIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 22 04:18:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<T4HwnSJEOtuUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:19:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<rPdfoSJEup+l0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 22 04:20:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<woeFpCJEjNql0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 22 04:21:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<VAv9qCJETOlnoNQc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 04:23:59 host2 sshd[3000652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 04:23:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<syGnriJE9LgvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 22 04:26:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<zdrauSJEbtyLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 04:28:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ZlM6wCJEwL6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 04:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<3v0awSJEPMRnOJRs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 22 04:28:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.91, session=<NhTBwSJEYOsUQcHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 22 04:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<NjydyiJE3uZnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 04:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<60umyiJEEIE+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:32:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<F8yUzSJEQLY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 04:33:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<DcdF0SJEyrM+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Nov 22 04:35:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<DicH2CJETuW8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.154.166.18
country_id: 1605651
description:
Nov 22 04:34:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=122.154.166.18, lip=66.85.158.91, session=<gkvU1iJEDtZ6mqYS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 04:35:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<PPiO2iJE1OI+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-22 04:36:51 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:47556: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-22 04:37:08 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:39384: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.124.58
country_id: 226074
description:
Nov 22 04:40:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=196.0.124.58, lip=66.85.158.91, TLS, session=<HXAA6SJEMbXEAHw6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:26 host2 pure-ftpd[3014973]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 04:40:55 host2 sshd[3015441]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 04:40:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<rB+/6yJETpgI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-22 04:40:40 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:55024: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:41:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<XYnp7SJEJoov+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:28 host2 pure-ftpd[3014992]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.120
country_id: 3469034
description:
Nov 22 04:40:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.199.120, lip=66.85.158.91, TLS, session=<wXJI6iJE6dOzvcd4>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 22 04:40:32 host2 pure-ftpd[3015147]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 04:41:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<UVkY8CJEuK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.248
country_id: 3469034
description:
Nov 22 04:41:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.53.165.248, lip=66.85.158.91, TLS, session=</a/i7iJE2pCxNaX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.15.98.132
country_id: 3865483
description:
Nov 22 04:42:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=181.15.98.132, lip=66.85.158.91, TLS, session=<mxOV8CJE49S1D2KE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 22 04:42:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yhVc8iJE4oEjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.60
country_id: 6252001
description:
Nov 22 04:43:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.60, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7dAs9iJEUNXN0h88>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 04:45:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<IxH8/iJELO4+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 04:46:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<JLppASNELGmnrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov 22 04:47:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dymDAyNEvdMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 22 04:49:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<eH7lCSNEnuql0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.83.201.41
country_id: 1819730
description:
Nov 22 04:49:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.83.201.41, lip=66.85.158.91, session=<DrItCyNEbq4vU8kp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:49:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<7TTCCyNEwp0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:49:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<VAJMDSNEIok+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 04:50:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55639: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 22 04:51:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4eIJESNEDMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 04:50:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<HbexECNEZro+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 22 04:51:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<CfRNEyNE/Jto7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 04:52:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<i5LvFCNEdqs+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 04:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<kNdbFSNEzss+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 04:53:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<hcEPGCNExJAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 04:53:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<IMOGGyNE7oDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.92.65
country_id: 6252001
description:
Nov 22 04:54:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.88.92.65, lip=66.85.158.91, session=<eGj5GyNEuNMvWFxB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 04:55:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<rNh1HyNExNI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-22 04:57:07 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:41630: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-11-22 04:56:35 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:43835: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-22 04:57:29 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:44130: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.154
country_id: 6252001
description:
Nov 22 04:57:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=<97uZKCNELK0SYROa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 04:59:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<rbnbLSNEWOySO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 22 04:58:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<s9/iLCNEprpAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 04:59:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8aOGMCNEoLM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.120.246
country_id: 6252001
description:
Nov 22 05:00:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=167.172.120.246, lip=66.85.158.91, session=<0T0rMyNEIEunrHj2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 05:00:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<l7DcMyNElKIzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 22 05:00:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Ucj+MyNEOr5n76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 22 05:02:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lSWjOiNEfNBHBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:04:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<uDNzPyNElso+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 05:04:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<+CJfQSNEHOE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:05:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<DGBbQyNEPsM+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.42
country_id: 3469034
description:
Nov 22 05:09:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.44.71.42, lip=66.85.158.91, TLS, session=<DcKdUiNEQa+xLEcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.144
country_id: 798544
description:
Nov 22 05:09:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=91.228.33.144, lip=66.85.158.91, TLS, session=<H+nJUyNEYA5b5CGQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 05:10:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<A0NEVyNEnuI+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.28
country_id: 6251999
description:
Nov 22 05:13:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.28, lip=66.85.158.92, session=<Oa85YSNEzomUcd0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:15:34 host2 sshd[3041406]: Disconnected from invalid user emilia 156.236.74.199 port 55644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 05:17:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<R3wobyNESq0+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:20:40 host2 sshd[3044426]: Disconnected from invalid user ricardo 156.236.74.199 port 59662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:22:11 host2 sshd[3045408]: Disconnected from invalid user xzh 151.36.128.57 port 6521 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 05:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<yywsfiNEHrA+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.178
country_id: 6252001
description:
Nov 22 05:22:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.117.178, lip=66.85.158.92, session=<XN0KgiNEwqesynWy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:23:05 host2 sshd[3046044]: Disconnected from invalid user proxyuser 156.236.74.199 port 60282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 05:23:08 host2 sshd[3046055]: Disconnected from invalid user admin 2.57.121.112 port 27175 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Nov 22 05:23:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JlUghiNEcNPG6xhN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 05:23:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<G4lJhiNEnug+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.18.253.210
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.18.253.210 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Nov 22 05:30:35 host2 sshd[3050879]: Disconnected from invalid user agent 156.236.74.199 port 44506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:32:04 host2 sshd[3051893]: Disconnected from invalid user debian 151.36.128.57 port 6531 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 05:36:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<k9A2syNE3k4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 05:37:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</P9ttiNEUrA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 05:37:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</sTotiNE4r5A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Nov 22 05:36:38 host2 sshd[3055525]: Disconnected from invalid user client 20.193.141.133 port 26112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 05:37:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ki4WtiNENrY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.167
country_id: 798544
description:
Nov 22 05:38:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=78.31.145.167, lip=66.85.158.91, TLS, session=<QARduCNEx6JOH5Gn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 05:38:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0knBuSNEcuOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 05:38:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<zmfcuSNEusYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 05:38:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<84w6uiNEMugv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 05:38:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<uZVeuiNEzuoEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.240
country_id: 690791
description:
Nov 22 05:37:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=176.103.2.240, lip=66.85.158.91, TLS, session=<MJZStyNENoCwZwLw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 05:37:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XraUuCNEDIM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 05:39:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<ttHUvCNEoqIzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:39:10 host2 sshd[3057028]: Disconnected from invalid user ftpuser 138.204.127.54 port 54465 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.207.52.158
country_id: 798544
description:
Nov 22 05:39:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=91.207.52.158, lip=66.85.158.91, TLS, session=<oq0uvSNEQMRbzzSe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 05:38:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<odr8uiNEBHanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 05:38:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<LpoVuyNEWOE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.189.167
country_id: 6252001
description:
2025-11-22 05:40:22 dovecot_plain authenticator failed for (splasm) [75.109.189.167]:52298: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 05:39:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<3GSuviNEcq52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.142
country_id: 3865483
description:
Nov 22 05:39:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=138.0.184.142, lip=66.85.158.91, TLS, session=<wKpVviNEL5uKALiO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 05:39:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<SCcUwCNE2MYrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Nov 22 05:41:27 host2 sshd[3059175]: Disconnected from invalid user terraria 20.193.141.133 port 54887 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.36.128.57
country_id: 3175395
description:
Nov 22 05:40:30 host2 sshd[3058392]: Disconnected from invalid user ricardo 151.36.128.57 port 6734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 05:40:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hfAWwyNEUNc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 05:40:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<vVQzwyNEwN0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 05:40:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<9goxwyNEZKYv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:41:16 host2 sshd[3059083]: Disconnected from invalid user nk 103.171.85.124 port 42756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-22 05:41:19 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (indly) [67.173.58.47]:55092: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 05:41:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<s+4fxyNEDtov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 05:42:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nbdZyCNETraPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:42:22 host2 sshd[3059798]: Disconnected from invalid user art 138.204.127.54 port 58228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 05:42:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lVi9yCNEiJE+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:43:06 host2 sshd[3060339]: Disconnected from invalid user art 103.171.85.124 port 32894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Nov 22 05:44:16 host2 sshd[3061202]: Disconnected from invalid user art 103.187.147.92 port 42282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 05:43:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ktG1zSNEIOOUcQQF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:43:48 host2 sshd[3060797]: Disconnected from invalid user amir 138.204.127.54 port 45156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 05:43:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<merSzSNE4rYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 05:44:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gaYmzyNEqAZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Nov 22 05:44:54 host2 sshd[3061608]: Disconnected from invalid user vpn 103.171.85.124 port 49188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 05:46:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<FGHD1SNEfIVn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:46:13 host2 sshd[3062876]: Disconnected from invalid user oleh 103.179.217.33 port 41160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Nov 22 05:46:17 host2 sshd[3062923]: Disconnected from invalid user cdn 95.85.114.218 port 35378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 05:46:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<n5DL2CNEFrc+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Nov 22 05:48:15 host2 sshd[3064869]: Disconnected from invalid user terraria 138.204.127.54 port 34184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 05:47:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uzT12iNE0t2l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:49:04 host2 sshd[3065525]: Disconnected from invalid user minecraft 34.92.146.210 port 50350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 05:49:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<3FPb4yNELKHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 05:50:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ltH95CNEDKRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 05:50:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<g+g65SNE6Mkv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:49:32 host2 sshd[3065888]: Disconnected from invalid user devuser 103.179.217.33 port 48818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 05:51:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<y2706CNE4LI+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 05:50:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<k1si5yNE9uOSO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Nov 22 05:51:40 host2 sshd[3067712]: Disconnected from invalid user cpd 177.44.220.67 port 54678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 05:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<nG/u6yNEftUI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 05:52:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<aYX76yNEYO6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 05:52:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<nXoR7iNEGsM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 05:53:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1Tx77yNEPEYvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:52:44 host2 sshd[3068366]: Disconnected from invalid user ts 34.92.146.210 port 35564 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov 22 05:54:20 host2 pure-ftpd[3069685]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-11-22 05:53:37 dovecot_login authenticator failed for 202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:49802: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-22 05:53:53 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:50114: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:53:56 host2 sshd[3069139]: Disconnected from invalid user tunnel 103.179.217.33 port 50548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 05:53:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jXkS8iNECNVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 05:54:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<KwDa8iNEltAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 05:55:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<3giK9iNESukI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 05:55:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ni1W9yNETOOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 05:54:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<MSS/9SNEvscEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 05:55:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<GGer9yNEMrqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 05:56:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<4Cg6+iNEyqIzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.217.33
country_id: 1643084
description:
Nov 22 05:55:29 host2 sshd[3070586]: Disconnected from invalid user mohammad 103.179.217.33 port 51842 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 05:56:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ZmEz+yNEsqV2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:56:57 host2 sshd[3072107]: Disconnected from invalid user oracle 34.92.146.210 port 43840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 05:57:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<SplI/SNE6ucrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 05:58:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3dqUACREgNAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Nov 22 05:58:18 host2 sshd[3073175]: Disconnected from invalid user abraham 34.92.146.210 port 46586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 05:57:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6aqI/yNEvscv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 05:57:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<e8V0ACRExuCPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.44.220.67
country_id: 3469034
description:
Nov 22 05:57:46 host2 sshd[3072714]: Disconnected from invalid user ubuntu 177.44.220.67 port 36738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 22 05:58:31 host2 sshd[3073253]: Disconnected from invalid user ricardo 154.91.81.176 port 50684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 05:58:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oUf3AiREdNAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 06:01:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<i2A/CyREvKwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 06:01:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<50mgDCREvuuUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 06:02:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<0l5nDyRECQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 06:03:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<cPbBEiRE+Iln9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 22 06:04:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<Vb8GFyREzuOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 06:04:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<FzjJGCREApgXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 06:04:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<EnBcGSRE1Kc+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 06:04:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<tXYoGCREyOil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.102.79
country_id: 1269750
description:
Nov 22 06:05:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=72.60.102.79, lip=66.85.158.91, session=<QXFcGyRESOhIPGZP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.89.103
country_id: 6252001
description:
Nov 22 06:06:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.165.89.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hAVzHyREgpQ0pVln>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 06:06:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<wOgZICRErtYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 06:06:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<O/ymICREWICSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.21
country_id: 798544
description:
Nov 22 06:07:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.216.29.21, lip=66.85.158.91, TLS, session=<Ir31ICREVs6y2B0V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.142.108.220
country_id: 1269750
description:
Nov 22 06:07:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=103.142.108.220, lip=66.85.158.91, TLS, session=<Ej8dIiRE2N9njmzc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 06:08:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<o9i1JCRE2ovIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.86.116.162
country_id: 6252001
description:
Nov 22 06:08:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.86.116.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HR0BJiREzIENVnSi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 06:08:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<nBlDJiRE0OY+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 06:09:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<5xNSKSREis+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 06:10:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<bS6YLCREHMsv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 06:10:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<FbCjLCRESoQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 06:09:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NhrnKSREDo1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 06:10:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fKPULSRE2tQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 06:10:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<d9Y0LiREvsE+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 06:11:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<EWQ9MCREIKlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 06:11:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<BaaqMCREQMYI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 06:12:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Af+8MiREuNAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 06:13:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<gTikOCRE6qynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 06:13:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FmuOOSREQoWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 06:14:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Hka/OiREZscv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 06:14:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<y2Y0OyRERpsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 06:13:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<X6XPOCREZqJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 06:13:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<OWUpOSREBKMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 06:14:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<H/MaPSREApsv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.112
country_id: 1643084
description:
Nov 22 06:16:37 host2 sshd[3085476]: Disconnected from invalid user developer 103.191.14.112 port 42288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 06:18:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<g+sGSSREYpY+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 06:18:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<exmiSSRETKIv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.14.112
country_id: 1643084
description:
Nov 22 06:18:06 host2 sshd[3086766]: Disconnected from invalid user test 103.191.14.112 port 45996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 06:19:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<pGPRTCRElseUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.2
country_id: 2510769
description:
Nov 22 06:20:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.145.43.2, lip=66.85.158.91, TLS, session=<bPZFTyRE9pW5kSsC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 06:20:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<wSVbUCREIrln9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 06:20:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F80yUCREgRNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.43
country_id: 3175395
description:
Nov 22 06:20:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.178.43, lip=66.85.158.91, TLS, session=<G2ldUCREn8XZGrIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 06:21:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Zaz1VSREkJyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 06:23:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<qfo8WyREluMv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 06:23:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<F8OKWiREhL2SO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 06:24:33 host2 sshd[3093631]: Disconnected from invalid user annabel 62.60.131.157 port 33488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.112
country_id: 1643084
description:
Nov 22 06:25:34 host2 sshd[3095407]: Disconnected from invalid user sonarqube 103.191.14.112 port 46514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 06:26:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<5Ip2ZSREfKU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 06:26:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<dS9dZiREqJjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 06:26:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<Lp4oZyRErtYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 06:26:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<BrIdZyREyrGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 06:28:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2yqabCRE3LwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 06:29:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<SbBvbyREFrlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 06:29:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<WmcRcCRExsMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 06:29:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DtTacCREfrtn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 22 06:28:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, session=<xWg8byRE4uyUcd3D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 06:29:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Ydq6ciREuoCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 06:30:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<avcdcyREoMMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 06:30:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ximBdiREvqKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 06:31:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<cDI9dyRELLcI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 06:31:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<aYEJeCREfBKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 06:30:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<X9NMdSRESr4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 06:31:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<1R6NdiREjIN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 06:31:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<30oBeSREOKMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 06:31:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<ybmceSREQr0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 06:32:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<oSnveiREcuUv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.142
country_id: 1880251
description:
Nov 22 06:33:24 host2 sshd[3103502]: Disconnected from invalid user admin 45.78.227.142 port 47394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov 22 06:34:00 host2 sshd[3103771]: Disconnected from invalid user p 103.179.218.243 port 57192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Nov 22 06:35:04 host2 sshd[3104644]: Disconnected from invalid user testserver 196.92.7.247 port 53126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 06:35:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<erJJhSREkII+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.176.47
country_id: 6252001
description:
Nov 22 06:35:49 host2 sshd[3105175]: Disconnected from invalid user ftpuser 192.3.176.47 port 35196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 06:35:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Ue8diCREvpcv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.94.88.49
country_id: 1036973
description:
Nov 22 06:36:16 host2 sshd[3105495]: Disconnected from invalid user kelvin 41.94.88.49 port 46150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.6.100.191
country_id: 3469034
description:
Nov 22 06:35:48 host2 sshd[3105151]: Disconnected from invalid user suser 201.6.100.191 port 51144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.6.100.191
country_id: 3469034
description:
Nov 22 06:37:24 host2 sshd[3106147]: Disconnected from invalid user ubuntu 201.6.100.191 port 52194 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.236.9
country_id: 6252001
description:
Nov 22 06:36:38 host2 pure-ftpd[3105734]: (?@172.174.236.9) [INFO] New connection from 172.174.236.9


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 06:36:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Z/AciyREiMg+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 22 06:37:59 host2 sshd[3106456]: Disconnected from invalid user p 20.197.33.53 port 52732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 06:38:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<6XuOkCRE0Ns+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 06:37:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Y3lmjiREJpxn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.176.47
country_id: 6252001
description:
Nov 22 06:37:42 host2 sshd[3106319]: Disconnected from invalid user shoply 192.3.176.47 port 40930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Nov 22 06:37:52 host2 sshd[3106394]: Disconnected from invalid user p 196.92.7.246 port 47118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.218.243
country_id: 1643084
description:
Nov 22 06:37:28 host2 sshd[3106179]: Disconnected from invalid user admin 103.179.218.243 port 57478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 06:37:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<CEjzjSREzNGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 06:38:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<DpPrkiREOow+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 06:39:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<6PT0kyREIJo+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.94.88.49
country_id: 1036973
description:
Nov 22 06:39:21 host2 sshd[3107626]: Disconnected from invalid user testserver 41.94.88.49 port 51904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 06:39:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<MmW5lCREdrql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 06:38:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TlzykSREtxpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 06:39:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<qa0vlSREnMqSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 06:39:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NLtEliREArE+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 06:40:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<FfUflyREuIIv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 06:40:58 host2 sshd[3108941]: Disconnected from invalid user admin 2.57.121.112 port 10447 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 06:41:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Q4UcmyRECp8+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.176.47
country_id: 6252001
description:
Nov 22 06:40:52 host2 sshd[3108898]: Disconnected from invalid user testserver 192.3.176.47 port 48082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Nov 22 06:41:56 host2 sshd[3109506]: Disconnected from invalid user shoply 154.144.225.226 port 34532 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.253
country_id: 6252001
description:
Nov 22 06:42:08 host2 pure-ftpd[3109641]: (?@20.64.105.253) [INFO] New connection from 20.64.105.253


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 22 06:42:15 host2 sshd[3109678]: Disconnected from invalid user autcom 20.197.33.53 port 57006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 06:41:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<uBRPnSREkoM+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.218.243
country_id: 1643084
description:
Nov 22 06:42:44 host2 sshd[3109954]: Disconnected from invalid user ubuntu 103.179.218.243 port 57988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 06:43:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<OdUXoiREaJcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 06:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<TDSDoiREZqA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-22 06:42:29 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:54344: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-22 06:42:36 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:35078: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.176.47
country_id: 6252001
description:
Nov 22 06:43:49 host2 sshd[3110551]: Disconnected from invalid user ec2-user 192.3.176.47 port 38544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.94.88.49
country_id: 1036973
description:
Nov 22 06:43:55 host2 sshd[3110644]: Disconnected from invalid user git 41.94.88.49 port 51912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 06:44:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8h+EpSREwJSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 06:44:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<5QzypiRE6Og+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Nov 22 06:44:35 host2 sshd[3111085]: Disconnected from invalid user ftpuser 196.92.7.246 port 40696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 06:44:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<DrxVqCREyujIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.176.47
country_id: 6252001
description:
Nov 22 06:45:17 host2 sshd[3111824]: Disconnected from invalid user p 192.3.176.47 port 38182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.94.88.49
country_id: 1036973
description:
Nov 22 06:45:30 host2 sshd[3111948]: Disconnected from invalid user teamspeak 41.94.88.49 port 38638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.6.100.191
country_id: 3469034
description:
Nov 22 06:45:51 host2 sshd[3112142]: Disconnected from invalid user p 201.6.100.191 port 57464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 06:46:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<ILKerCRE4FUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 06:46:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<koTJrCREwIqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 06:46:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<asgsrSREbs0+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 06:47:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ytfnsCREuIQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 06:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<MVAPriREMNIEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 06:46:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cK4XryREOLlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 06:47:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1EHzsCRErrUv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 22 06:47:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<3p7FsiRERP/CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 06:47:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<2h7hsiREQukI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 06:48:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<1qoGtSREgLx2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Nov 22 06:48:34 host2 sshd[3114154]: Disconnected from invalid user sammy 196.92.7.246 port 55002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 06:48:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<PMqYtiRE2JWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 06:49:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<w6FstyREcMWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 06:49:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<w2v5tyREAqVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 06:49:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+Q21uCREFOArpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 06:49:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<vKGPuSREaKMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 06:49:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<MBr4uSRE+rAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 06:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<0SdcvyRERqgI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.6.100.191
country_id: 3469034
description:
Nov 22 06:51:07 host2 sshd[3115925]: Disconnected from invalid user ibrahim 201.6.100.191 port 60650 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.238.137
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.26.238.137 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 22 06:52:06 host2 sshd[3116654]: Disconnected from invalid user testserver 20.197.33.53 port 36268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 06:52:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<qX1kwyREQqY+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 22 06:53:31 host2 sshd[3117339]: Disconnected from invalid user git 20.197.33.53 port 46206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 06:53:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<SMujxyRE0o0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Nov 22 06:53:46 host2 sshd[3117488]: Disconnected from invalid user adib 196.92.7.246 port 51084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 06:55:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ha3azSRExJEXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 06:55:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Pxn5zSREzoRn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 06:56:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<aMvu0CRElpCSO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Nov 22 06:56:22 host2 sshd[3119764]: Disconnected from invalid user test1 154.144.225.226 port 60060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 06:55:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<mXFnzyRE5uaUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 06:57:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<OGU51CRE2pAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 06:57:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<NJ1i1CREbLel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 06:57:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<qWIF1SREkyFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Nov 22 06:57:37 host2 sshd[3120512]: Disconnected from invalid user autcom 196.92.7.249 port 47716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 06:57:52 host2 sshd[3120686]: Disconnected from invalid user admin 2.57.121.112 port 58915 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 06:59:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<M+NW3SREdqYv+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.20
country_id: 1605651
description:
Nov 22 06:59:52 host2 pure-ftpd[3122125]: (?@103.176.152.20) [INFO] New connection from 103.176.152.20


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.246
country_id: 2542007
description:
Nov 22 07:00:17 host2 sshd[3122643]: Disconnected from invalid user usman 196.92.7.246 port 37316 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 07:00:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<IBJ33yRE0q8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 07:01:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<QmW54iRE7NkXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.138.65
country_id: 2542007
description:
Nov 22 07:01:35 host2 sshd[3123646]: Disconnected from invalid user ec2-user 81.192.138.65 port 44898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 07:01:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<COaw5CREXHiYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.193.41
country_id: 3865483
description:
Nov 22 07:03:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.96.193.41, lip=66.85.158.91, TLS, session=<KnbI6CREBbu6YMEp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 07:02:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<s3sc5yRE0uqPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Nov 22 07:02:50 host2 sshd[3124459]: Disconnected from invalid user qa 196.92.7.247 port 50990 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.155.15.216
country_id: 130758
description:
Nov 22 07:02:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.155.15.216, lip=66.85.158.91, TLS, session=<f0qm5yRE37m5mw/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 07:03:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<n+Ay6yRE8s/IMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.144.225.226
country_id: 2542007
description:
Nov 22 07:04:06 host2 sshd[3125926]: Disconnected from invalid user kelvin 154.144.225.226 port 48012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 07:04:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<diL87CRELogEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 07:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<x3Aq7SRErDwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 07:04:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<CBjI7CRE9Ok+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 07:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<kzgm7SRE/Kwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 07:04:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+mIl7yREkLpA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 07:05:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<xxxr8yREUKEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 07:06:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<JDPQ9CRE4MZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 07:06:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<upAM9SREUvOnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.247
country_id: 2542007
description:
Nov 22 07:06:49 host2 sshd[3128021]: Disconnected from invalid user irene 196.92.7.247 port 45002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 07:07:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<v8iT+CREpN+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 07:07:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Iqdn+SREIOQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 07:07:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<O/NI+iRE9o8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 07:07:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<qy6o+iREjqMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 07:07:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<sYr++CRE5pUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 07:09:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<nnGPASVEzIhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 07:11:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<NCLPByVEEoUv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 22 07:11:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nxEuCCVECP/CpRCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 07:12:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<WOezCiVEnNw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 07:11:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<xoxvByVEVJkI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.90
country_id: 6252001
description:
Nov 22 07:11:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.90, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tkWoByVEM92TuYRa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 07:13:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<uF20DSVEMtqSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 07:13:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<PtVbDiVE5sFn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 07:14:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<rtNUESVELuSUcQQF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.144.225.226
country_id: 2542007
description:
Nov 22 07:13:35 host2 sshd[3132349]: Disconnected from invalid user dev02 154.144.225.226 port 41410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 07:14:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<l8mjEiVE3J8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 07:14:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<5+u8EiVEYp0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 07:15:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<yaB/FCVE+MCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 07:16:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<o245GSVErwVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 07:16:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<jLAiGSVEaoYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 07:17:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<t4gwHSVEUIsXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 07:17:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Rs1kHSVEOoc+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 07:19:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zdSNIiVEMrSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 07:19:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UfkIJCVE1FuYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.92.7.249
country_id: 2542007
description:
Nov 22 07:20:20 host2 sshd[3136739]: Disconnected from invalid user nico 196.92.7.249 port 58484 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 07:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0YFJKiVEhqQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-22 07:21:23 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:47692: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 07:21:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<I5m/KyVETMUEkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-22 07:21:50 dovecot_login authenticator failed for (nsg-corporate-105.85.185.122.airtel.in) [61.95.192.158]:34032: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 07:22:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<frP/LCVE+JbIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 07:22:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wV6lLiVEHDEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 07:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<CoFDMCVEPt1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 07:23:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</LeUMSVEKKMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 07:24:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<abA/NCVElIV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 07:24:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<4hukNCVEYMgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 07:24:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<LowbNCVEqkenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 07:25:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<UfpTOSVE8Kcv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 07:25:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<tZ9+OSVE3rk+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 07:25:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<kdN4OSVEBrorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 07:25:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<WLGpOSVENLuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 07:26:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<yhVQOyVEsKMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.232
country_id: 3175395
description:
Nov 22 07:27:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.15.170.232, lip=66.85.158.91, TLS, session=<HVxiPiVElMm5D6ro>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.93
country_id: 3175395
description:
Nov 22 07:27:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=171.22.235.93, lip=66.85.158.91, TLS, session=<h8pqPyVEvZSrFutd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 07:29:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GqPhRyVERukv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 07:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<zU+7SSVEBo9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 07:30:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<U6dXSiVEPN6SO+QY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 22 07:30:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, session=<HgXNSiVENf8t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 07:31:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<pXQ4TyVE7s1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 07:32:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<+LIPUSVEyq4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 07:31:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9vrETiVESIoI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 07:32:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<a5R1UyVEFpKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 07:33:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<tMaQVCVESMKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 07:32:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<z/onUyVE0oA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 07:33:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<5mccViVE5Jsv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 07:33:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<u1XKVyVEqqw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 07:34:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<cSwzWyVE6pE+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 07:35:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<reRRXSVECAxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 07:35:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Lh48XiVEhtiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 07:37:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<taXeYiVEHj+YIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.237
country_id: 6252001
description:
Nov 22 07:36:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.237, lip=66.85.158.91, session=<kqrtYCVEa5nDuEzt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.239
country_id: 6252001
description:
Nov 22 07:36:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.239, lip=66.85.158.91, session=<RjaGYSVEo+PDuEzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.233
country_id: 6252001
description:
Nov 22 07:36:48 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.233, lip=66.85.158.91, session=<ImT6YSVE96/DuEzp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.238
country_id: 6252001
description:
Nov 22 07:36:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.238, lip=66.85.158.91, session=<+LwsYiVEVd7DuEzu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 07:38:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7wZcZyVEIJwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.50
country_id: 690791
description:
Nov 22 07:39:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.17.124.50, lip=66.85.158.91, TLS, session=<UB4SaiVEGM+5EXwy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.182.22.172
country_id: 690791
description:
Nov 22 07:39:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=195.182.22.172, lip=66.85.158.91, TLS, session=<akX8aCVEXtDDthas>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 07:39:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<2CnRaiVElJgEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 07:40:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<GfIDbyVEBnIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 07:40:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<OfpGbyVE7rHIMGRT>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.110
country_id: 2635167
description:
Nov 22 07:41:04 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.110, lip=66.85.158.91, TLS, session=<QbBBcSVEqbC594lu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 07:41:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</wLgciVEbuJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 07:41:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<GUVlcyVEOsZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 07:42:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<olWWdSVE3EinYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 07:42:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<dDLmdSVEFIEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 07:42:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LZDedyVEisYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 07:43:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<I09JeCVEPos+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 07:43:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<cg4KeSVERN0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 07:44:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<7K1FfCVE0KMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 07:43:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<N0zQeiVEKJOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 07:45:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<r///gSVE+ok+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 07:47:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ekxuhyVEbN8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 07:47:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<EiHKhiVEzsuSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 07:47:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<dQ19iCVEEMY+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 07:49:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Qt6/jiVEiK4+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 07:49:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<codHjyVE9L0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 07:49:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Z57/jyVEzrNn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 07:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+ZdvkiVEXoJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 07:50:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+jNQkyVEjsKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 07:50:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<iGoPlCVEpOMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 07:51:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<NRJElSVEZtY+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 07:51:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<smLzliVEtukI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 07:52:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<cDAJmSVEVq2UcQQF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.158.225.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 192.158.225.219 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 07:52:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<gq6bmiVE5o6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 07:54:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<v7DCoCVEhtU+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 07:54:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<RhTkoSVE1PmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 07:54:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IO8WoiVEgxVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 07:55:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<rSyjoyVE+Ks+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 07:55:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<8BPJpCVElJMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 07:56:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<z+KzqSVEmI8EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.164.10
country_id: 3469034
description:
Nov 22 07:58:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.129.164.10, lip=66.85.158.91, TLS, session=<BRcLriVEtYqxgaQK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 07:57:59 host2 sshd[3165742]: Disconnected from invalid user admin 2.57.121.112 port 15123 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 07:58:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KWwisCVE7tQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.70
country_id: 3865483
description:
Nov 22 07:58:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=181.225.195.70, lip=66.85.158.91, TLS, session=<NoBPryVEdN+14cNG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 07:58:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<UOgWsSVE4NfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 07:59:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<NCAPsiVEVLA+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 07:59:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<vznDsiVE0p52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.202
country_id: 3865483
description:
Nov 22 08:00:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.181.100.202, lip=66.85.158.91, TLS, session=<2dh7tCVEUam+tWTK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.18
country_id: 798544
description:
Nov 22 07:59:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=178.216.25.18, lip=66.85.158.91, TLS, session=<ISBAsyVEJ+my2BkS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 08:00:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<yPD1tiVEhEqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 08:00:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<VUwStyVEsONA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 08:00:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<4aJytyVElKgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 08:01:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<RU4quSVE6JIrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-22 08:01:26 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:16332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 08:00:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<fT/ftiVEiO0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 08:02:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<U1o2vSVEuJmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 08:02:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<bLyNvSVEYqkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-22 08:01:32 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:46536: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 08:01:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<0oI6uyVEFo0+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 08:02:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<8DHJvSVEEKQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 08:02:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<G10qviVE5sg+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 08:04:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<ofGvwyVEcLOSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 08:05:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bgqhxyVEJNUv7PP+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.140.118
country_id: 2802361
description:
Nov 22 08:06:08 host2 pure-ftpd[3172051]: (?@34.78.140.118) [INFO] New connection from 34.78.140.118


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 08:07:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<5s1jziVEaM0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 08:08:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<Xk+A0iVEROov+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.167
country_id: 6252001
description:
Nov 22 08:07:34 host2 pure-ftpd[3172845]: (?@205.210.31.167) [INFO] New connection from 205.210.31.167


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 08:07:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<05pH0SVEdoJn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 08:08:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ut+O0yVEaK+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 08:09:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<9p0K1yVExq6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 08:11:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<cYHy3CVEEu1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 08:11:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<JM3u3SVEkp+UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 08:12:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<A5x94CVEutoI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 08:13:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<soFD5iVEOuI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 08:14:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<x41l5yVE+Btniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 08:14:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<DyhG6SVE1OMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 08:16:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<8Kez8CVEKl8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 08:18:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<fn6Z9SVE8r8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 08:17:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<UH098iVEiMF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.248
country_id: 953987
description:
Nov 22 08:17:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=102.129.56.248, lip=66.85.158.91, TLS, session=<Q9988SVEou1mgTj4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 08:17:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<xiZS8yVEPr/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.251.173
country_id: 2395170
description:
Nov 22 08:17:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=41.223.251.173, lip=66.85.158.91, TLS, session=<D0jG8iVE/YIp3/ut>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 08:19:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vkx7+SVE/LYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 08:19:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Bjaz+SVEbtAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 08:19:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<G00Z+iVEsJunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 08:19:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<nOWh+yVE/N5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 08:21:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<XiEoACZEOLKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 08:20:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<CWPK/yVEVN6SO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 08:21:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<g5CaACZENqQzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.246
country_id: 6252001
description:
Nov 22 08:21:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.246, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xaWDAiZEwNrN0h/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 08:23:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DK33ByZE5Mov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 08:25:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<2idgDiZEeN0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 08:25:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<ao63ESZEQMkv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 08:26:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<yXhAEyZEWNpn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 08:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uJaNFCZEUKqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 08:26:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<F+G6FCZEWpal6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 08:27:44 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52303: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 08:28:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<OurhGiZEnqc+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.211.27
country_id: 1269750
description:
Nov 22 08:29:45 host2 sshd[3188473]: Disconnected from invalid user ruslan 122.166.211.27 port 41626 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.150
country_id: 6252001
description:
Nov 22 08:30:33 host2 pure-ftpd[3189155]: (?@147.185.132.150) [INFO] New connection from 147.185.132.150


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 08:30:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<mz0/IiZErIQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 08:30:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<MoCRIiZEwOKUcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.17
country_id: 1643084
description:
Nov 22 08:30:57 host2 sshd[3189367]: Disconnected from invalid user devuser 103.59.94.17 port 45446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 08:30:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<QvuMIyZEko1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 08:30:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<tr/JICZE9sCYIMkL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.211.27
country_id: 1269750
description:
Nov 22 08:31:12 host2 sshd[3189503]: Disconnected from invalid user proxyuser 122.166.211.27 port 34510 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 08:33:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<0JfgKiZEBswI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.21
country_id: 3865483
description:
Nov 22 08:33:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.230.80.21, lip=66.85.158.91, TLS, session=<e1QpKiZEJ+Yt5lAV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 08:32:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<RVYRKCZE7KUEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.211.27
country_id: 1269750
description:
Nov 22 08:32:36 host2 sshd[3190193]: Disconnected from invalid user info 122.166.211.27 port 59518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.17
country_id: 1643084
description:
Nov 22 08:32:56 host2 sshd[3190388]: Disconnected from invalid user socksuser 103.59.94.17 port 47062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 08:33:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<E5dtLSZEmSJniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.211.27
country_id: 1269750
description:
Nov 22 08:34:00 host2 sshd[3190997]: Disconnected from invalid user zahid 122.166.211.27 port 58196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Nov 22 08:33:14 host2 sshd[3190573]: Disconnected from invalid user vscode 90.180.197.128 port 53777 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.106.141.212
country_id: 2963597
description:
Nov 22 08:33:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.106.141.212, lip=66.85.158.91, TLS, session=<zBNYKyZEZLZZao3U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 08:34:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<GDYsMSZEhkgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 08:34:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<DVWrMSZEDMB2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 22 08:35:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LqQWNCZEQ82TuYVQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 08:35:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<r70cNCZEHNsv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.54.2
country_id: 6252001
description:
Nov 22 08:35:38 host2 sshd[3192411]: Disconnected from invalid user gitlab-runner 107.175.54.2 port 44732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 08:36:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<+TS/NSZEoIzIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.231
country_id: 6252001
description:
Nov 22 08:36:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.231, lip=66.85.158.91, session=<o9oKNiZE37Nb5qjn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.80.106
country_id: 6252001
description:
Nov 22 08:36:45 host2 sshd[3193063]: Disconnected from invalid user odoo 107.173.80.106 port 49968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 08:37:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<fsZ5OSZE4torpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.101
country_id: 6252001
description:
Nov 22 08:36:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.101, lip=66.85.158.91, session=<3sa0NiZErdBb5qhl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 22 08:36:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<x48pNyZEKvaTuYVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.103
country_id: 6252001
description:
Nov 22 08:36:31 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.103, lip=66.85.158.91, session=<bjSHNyZE/eRb5qhn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.97
country_id: 6252001
description:
Nov 22 08:36:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.97, lip=66.85.158.91, session=<O2W2NyZELaxb5qhh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Nov 22 08:36:38 host2 sshd[3192995]: Disconnected from invalid user user 90.180.197.128 port 57476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 08:37:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<PysXOyZEnPanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 08:37:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<xEPWOyZEpu2SO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 08:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<RCXOPyZEVpFA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.80.106
country_id: 6252001
description:
Nov 22 08:38:58 host2 sshd[3194466]: Disconnected from invalid user frontend 107.173.80.106 port 40956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 08:38:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<r1kqPSZEbosI04Sw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.180.197.128
country_id: 3077311
description:
Nov 22 08:38:47 host2 sshd[3194362]: Disconnected from invalid user admin 90.180.197.128 port 59036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Nov 22 08:39:52 host2 sshd[3194941]: Disconnected from invalid user stefan 90.180.197.128 port 53048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 08:40:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<aVD0QyZEcKQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 08:40:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+1cKRCZEvo+WXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.17
country_id: 1643084
description:
Nov 22 08:40:06 host2 sshd[3195245]: Disconnected from invalid user devuser 103.59.94.17 port 58238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-22 08:40:39 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:54730: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-11-22 08:41:09 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:45680: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.80.106
country_id: 6252001
description:
Nov 22 08:41:14 host2 sshd[3196328]: Disconnected from invalid user monitor 107.173.80.106 port 44062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 08:41:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<l/mWSCZEqMEv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.17
country_id: 1643084
description:
Nov 22 08:41:34 host2 sshd[3196489]: Disconnected from invalid user test_user 103.59.94.17 port 39844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 08:42:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<5gjxSyZEAos+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 08:43:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<zv+6TiZE6I0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-11-22 08:43:33 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:52701: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 08:43:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<qwfOUCZEBqgv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-11-22 08:43:55 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:44216: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 08:43:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<I6EwTyZE6u0v+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.80
country_id: 6252001
description:
Nov 22 08:43:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.80, lip=66.85.158.92, TLS, session=<KYsVUCZEcvSTuYVQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 08:44:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uhn+UiZEbJiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 08:45:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<HDr3VSZEnr9n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 08:45:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<KSpkViZE2rml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 08:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<3kA2WyZEht0+PIOJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 08:48:02 host2 sshd[3202888]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 08:48:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<RUKmYCZEYKaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 08:47:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<wG9ZXyZEvMk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 08:48:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<N9INYiZE9Oov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 22 08:48:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JJVZYiZEisIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 08:48:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<L0BPYyZE5K4+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 08:49:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<mwevZiZEosaUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 08:50:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<tF/mZyZERocEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 08:50:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Z2ndaSZESIs+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 08:51:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<KgtoayZE4JZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.144
country_id: 6290252
description:
Nov 22 08:52:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=217.17.108.144, lip=66.85.158.91, TLS, session=<vu7pbyZEue3ZEWyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 08:52:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<opMbciZEZn4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 08:52:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=</H0eciZEaup2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.26
country_id: 798544
description:
Nov 22 08:53:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=178.219.98.26, lip=66.85.158.91, TLS, session=<hkOXcSZEwIWy22Ia>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 08:53:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<fZP4cyZEzytniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 08:53:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<VzI3dSZETL0I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 08:53:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<PTc8cyZEnu0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 08:53:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<YsdycyZEQtAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.237.73.163
country_id: 798544
description:
Nov 22 08:53:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=91.237.73.163, lip=66.85.158.91, TLS, session=<KIvnciZE2Ixb7Umj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.96
country_id: 3469034
description:
Nov 22 08:53:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=168.0.224.96, lip=66.85.158.91, TLS, session=<UxsGdCZE7pyoAOBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-22 08:54:05 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:58861: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-11-22 08:54:14 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:49258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 08:54:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<QRFXeCZELomSO+QY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-22 08:55:19 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:58434: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 08:55:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<uVLHeiZEoJErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 08:55:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<sIQmeyZEhMfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 08:55:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NX+FfCZEkjOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 08:56:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<cq9lgCZE2LQI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 08:56:58 host2 sshd[3210325]: Disconnected from invalid user destany 62.60.131.157 port 51541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-11-22 08:57:37 dovecot_login authenticator failed for ([59.96.62.29]) [59.96.62.29]:33638: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-22 08:57:59 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:45016: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 08:57:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YgwZhCZE2pFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 08:58:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<pHZlhSZErIk+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 08:59:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<88MmiCZEmKQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 08:59:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<yZpGiSZE5MI+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 08:59:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<HGJbiSZE9rcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 08:59:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<sxjpiSZElsk+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 08:59:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2VgziiZEUKWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 09:01:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<hAgGjyZEcI4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 09:01:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zqBZkCZE0uaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 09:01:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<nHiDkCZEWJsv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 09:03:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<JG9dmCZE/t9n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 09:03:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<40WFmCZEBI+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 09:04:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<UeeknCZEGuo+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Nov 22 09:04:45 host2 sshd[3215841]: Disconnected from invalid user bb 43.133.148.170 port 56146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 22 09:05:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fkkoniZEJP/CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 09:05:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<YpeUnyZElImYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 09:05:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7HVQoCZEjuIv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 22 09:06:47 host2 sshd[3217068]: Disconnected from invalid user user 51.254.103.32 port 42246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 09:07:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ZTWXpSZE2I8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 09:07:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<0LSvpiZEQIUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 09:08:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<GrGvqiZE5tWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 09:09:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<PVRHriZEPuY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.188
country_id: 3469034
description:
Nov 22 09:11:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.120.72.188, lip=66.85.158.91, TLS, session=<ilzQsSZEGOW7eEi8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 09:11:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MyjrsiZEZKln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 09:11:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LqXhsiZEMO0v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Nov 22 09:10:19 host2 sshd[3219518]: Disconnected from invalid user postgres 43.133.148.170 port 50148 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 09:10:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zEizsSZEqtJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.186
country_id: 953987
description:
Nov 22 09:11:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=102.64.41.186, lip=66.85.158.91, TLS, session=<xdcXsyZEzYVmQCm6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov 22 09:11:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<C7YjtSZEvIGSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 09:11:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</rFosyZEXu8vTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 22 09:12:56 host2 sshd[3221038]: Disconnected from invalid user mine 172.191.157.64 port 43898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 09:12:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SVt3uCZEBTJniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 09:13:15 host2 sshd[3221299]: Disconnected from invalid user destany 62.60.131.157 port 50854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 09:13:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<2AVGuyZE5rUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 09:14:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qPt3vSZE9B6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 09:14:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<opOsviZE5t3IMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 09:14:30 host2 sshd[3221937]: Disconnected from invalid user admin 2.57.121.112 port 35820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 09:14:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<vhZxwCZEhK4I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 09:15:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PMZFwiZEhNwI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.157.64
country_id: 6252001
description:
Nov 22 09:15:32 host2 sshd[3222649]: Disconnected from invalid user nikhil 172.191.157.64 port 53440 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 09:16:35 host2 sshd[3223312]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 22 09:17:00 host2 sshd[3223570]: Disconnected from invalid user ec2-user 51.254.103.32 port 53500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 09:17:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<I5s6yCZEbopA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 09:17:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<5qgKySZEhrI+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 09:17:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4IuEySZEHJE+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 09:17:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<aLHVySZEbq4v7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 22 09:18:01 host2 sshd[3224514]: Disconnected from invalid user default 51.254.103.32 port 43488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Nov 22 09:18:45 host2 sshd[3224995]: Disconnected from invalid user ec2-user 43.133.148.170 port 49186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 09:18:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<6JKgzCZEyKQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 09:18:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Tf/0zCZEZLKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 09:18:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JvGPzSZElJ0v+yXY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.80.225
country_id: 99237
description:
[2025-11-22 09:19:10 +0530] info [whostmgrd] 185.206.80.225 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 09:19:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<B5Ym0CZE2MeWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 09:19:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<BxLWzyZErIsv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 09:20:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<Alv00yZEPok+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 09:20:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<oPrn1SZEpIs+PIcp>


