# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.37
country_id: 953987
description:
Nov 20 01:53:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=102.64.37.37, lip=66.85.158.91, TLS, session=<iPAPWPhD5LlmQCUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:54:06 host2 sshd[761552]: Disconnected from invalid user esbuser 196.189.116.182 port 58466 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 01:55:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.212, lip=66.85.158.91, session=<hV7gYPhDMsiUcdbU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:58:08 host2 sshd[764635]: Disconnected from invalid user hacker 196.189.116.182 port 55552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.116.182
country_id: 337996
description:
Nov 20 01:59:32 host2 sshd[765421]: Disconnected from invalid user runner 196.189.116.182 port 37536 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 20 02:02:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HxdbefhD8vRChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.85.20
country_id: 3865483
description:
Nov 20 02:04:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=190.181.85.20, lip=66.85.158.91, TLS, session=<DE7hf/hDHra+tVUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.193
country_id: 690791
description:
Nov 20 02:04:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=176.103.25.193, lip=66.85.158.91, TLS, session=<bAcmgfhDEc2wZxnB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.36.38
country_id: 99237
description:
[2025-11-20 02:08:41 +0530] info [whostmgrd] 169.224.36.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:16:39 host2 sshd[776444]: Disconnected from invalid user ubuntu 187.110.238.50 port 50852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:17:54 host2 sshd[777150]: Disconnected from invalid user masud 45.78.227.155 port 57564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:17:18 host2 sshd[776791]: Disconnected from invalid user student10 107.150.106.178 port 57502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.106.178
country_id: 6252001
description:
Nov 20 02:19:06 host2 sshd[777802]: Disconnected from invalid user danil 107.150.106.178 port 53136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:20:52 host2 sshd[778955]: Disconnected from invalid user pivpn 51.83.129.117 port 46694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:21:32 host2 sshd[779313]: Disconnected from invalid user rich 198.46.207.98 port 46670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:21:40 host2 sshd[779356]: Disconnected from invalid user syncthing 187.110.238.50 port 50080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:22:23 host2 sshd[779698]: Disconnected from invalid user ica 41.33.91.226 port 58744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:23:05 host2 sshd[780043]: Disconnected from invalid user last 51.83.129.117 port 47864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:23:11 host2 sshd[780079]: Disconnected from invalid user newftpuser 187.110.238.50 port 52684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:23:43 host2 sshd[780349]: Disconnected from invalid user mostafa 41.33.91.226 port 39806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:24:44 host2 sshd[781089]: Disconnected from invalid user kate 187.110.238.50 port 55286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:24:14 host2 sshd[780810]: Disconnected from invalid user wanghao 51.83.129.117 port 48440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:24:21 host2 sshd[780883]: Disconnected from invalid user qendrimellupo 103.117.56.152 port 41176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.129.117
country_id: 798544
description:
Nov 20 02:25:20 host2 sshd[781527]: Disconnected from invalid user git 51.83.129.117 port 49014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 20 02:26:22 host2 sshd[782208]: Disconnected from invalid user sachi 187.110.238.50 port 57890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:27:41 host2 sshd[782828]: Disconnected from invalid user devops 103.193.178.248 port 38540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:27:09 host2 sshd[782573]: Disconnected from invalid user mostafa 198.46.207.98 port 34614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Nov 20 02:27:21 host2 sshd[782662]: Disconnected from invalid user mark 41.33.91.226 port 45520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.207.98
country_id: 6252001
description:
Nov 20 02:28:14 host2 sshd[783140]: Disconnected from invalid user testuser 198.46.207.98 port 41928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:29:13 host2 sshd[783688]: Disconnected from invalid user helpdesk 103.193.178.248 port 56354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:30:55 host2 sshd[784772]: Disconnected from invalid user temp 103.117.56.152 port 57792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.178.248
country_id: 1643084
description:
Nov 20 02:33:06 host2 sshd[785919]: Disconnected from invalid user roman 103.193.178.248 port 53668 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 02:36:22 host2 sshd[788023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:39:44 host2 sshd[789433]: Disconnected from invalid user sachi 45.78.227.155 port 44094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 02:41:43 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63641: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-20 02:41:51 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:51612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-20 02:41:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:50426: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 02:41:40 host2 sshd[791673]: Disconnected from invalid user ali 62.60.131.157 port 60033 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:40 host2 pure-ftpd[792337]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 02:42:47 host2 pure-ftpd[792405]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.65
country_id: 2510769
description:
Nov 20 02:43:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=139.28.190.65, lip=66.85.158.91, TLS, session=<62tYDflDbuCLHL5B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.124
country_id: 298795
description:
Nov 20 02:44:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=45.67.155.124, lip=66.85.158.91, TLS, session=<mg54DvlD3LAtQ5t8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:44:09 host2 sshd[793054]: Disconnected from invalid user ben 62.219.172.50 port 59918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:46:27 host2 sshd[794668]: Disconnected from invalid user gpu 62.219.172.50 port 35590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:47:26 host2 sshd[795534]: Disconnected from invalid user system 103.117.56.152 port 33924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:47:34 host2 sshd[795642]: Disconnected from invalid user victor 62.219.172.50 port 51794 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.164.177.29
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.164.177.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.146.155.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.146.155.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.56.153.139
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 93.56.153.139 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.164.100.80
country_id: 2658434
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 31.164.100.80 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-20 02:49:12 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51746: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.49.162
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.49.162 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.91.124.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.91.124.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-11-20 02:49:48 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:51670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Nov 20 02:50:30 host2 sshd[797399]: Disconnected from invalid user fad 103.117.56.152 port 35454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:50:33 host2 sshd[797441]: Disconnected from invalid user ir 179.32.207.251 port 48730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:51:50 host2 sshd[798217]: Disconnected from invalid user frappe 179.32.207.251 port 51984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.219.172.50
country_id: 294640
description:
Nov 20 02:52:11 host2 sshd[798380]: Disconnected from invalid user steamcmd 62.219.172.50 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Nov 20 02:53:08 host2 sshd[799011]: Disconnected from invalid user steamcmd 179.32.207.251 port 55216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.155
country_id: 1880251
description:
Nov 20 02:54:15 host2 sshd[799348]: Disconnected from invalid user ubuntu 45.78.227.155 port 37074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.233.185.13
country_id: 798544
description:
Nov 20 03:00:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.233.185.13, lip=66.85.158.91, TLS, session=<NxhVSPlDtspb6bkN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.243.111
country_id: 3469034
description:
Nov 20 03:00:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.209.243.111, lip=66.85.158.91, TLS, session=<72Z2SflD8Ny60fNv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 03:05:07 host2 sshd[807159]: Disconnected from invalid user user 2.57.121.25 port 51592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 20 03:06:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<yHY5X/lDkKCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:11:35 host2 sshd[810909]: Disconnected from invalid user himanshu 206.217.136.36 port 57842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.201
country_id: 6252001
description:
Nov 20 03:11:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.201, lip=66.85.158.91, session=<C0w4cvlDmPjN0h/J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:11:44 host2 sshd[810970]: Disconnected from invalid user pivpn 41.82.208.178 port 28263 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:11:46 host2 sshd[810985]: Disconnected from invalid user ahmed 45.79.189.171 port 59158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:12:54 host2 sshd[811567]: Disconnected from invalid user nodeuser 45.79.189.171 port 53558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.201
country_id: 3175395
description:
Nov 20 03:14:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=171.22.235.201, lip=66.85.158.91, TLS, session=<dwfPeflDesqrFuvJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.86.60
country_id: 3469034
description:
Nov 20 03:14:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=131.196.86.60, lip=66.85.158.91, TLS, session=<ncz1evlD9oiDxFY8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:15:07 host2 sshd[812771]: Disconnected from invalid user trading 45.79.189.171 port 39990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Nov 20 03:15:19 host2 sshd[812921]: Disconnected from invalid user yyy 41.82.208.178 port 1565 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 20 03:17:03 host2 sshd[813744]: Disconnected from invalid user andrey 206.217.136.36 port 48258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.79.189.171
country_id: 6252001
description:
Nov 20 03:17:14 host2 sshd[813813]: Disconnected from invalid user ubuntu 45.79.189.171 port 53472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:17:38 host2 sshd[813975]: Disconnected from invalid user admin 161.10.72.136 port 47672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:23:31 host2 sshd[816560]: Disconnected from invalid user ubuntu 161.10.72.136 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.10.72.136
country_id: 3686110
description:
Nov 20 03:24:57 host2 sshd[817215]: Disconnected from invalid user git 161.10.72.136 port 59834 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-20 03:25:29 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:60435: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.116
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819321]: (?@195.184.76.116) [INFO] New connection from 195.184.76.116


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.118
country_id: 6252001
description:
Nov 20 03:29:28 host2 pure-ftpd[819323]: (?@195.184.76.118) [INFO] New connection from 195.184.76.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-20 03:46:54 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:60530: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-20 03:47:11 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:38956: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.99.35
country_id: 1269750
description:
Nov 20 03:50:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.107.99.35, lip=66.85.158.91, TLS, session=<znBS+vlDj95na2Mj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.4
country_id: 1269750
description:
Nov 20 03:50:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.51.223.4, lip=66.85.158.91, TLS, session=<rYik+/lDEp1nM98E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.97.152
country_id: 3469034
description:
Nov 20 03:51:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.97.152, lip=66.85.158.91, TLS, session=<sXQkAPpDpoixLGGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.194
country_id: 1269750
description:
Nov 20 03:52:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.51.223.194, lip=66.85.158.91, TLS, session=<yu5cAfpDfe1nM9/C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:56:14 host2 sshd[837431]: Disconnected from invalid user admin 152.32.191.75 port 54468 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:43 host2 pure-ftpd[837933]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.212
country_id: 6251999
description:
Nov 20 03:56:34 host2 pure-ftpd[837805]: (?@148.113.214.212) [INFO] New connection from 148.113.214.212


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:57:29 host2 sshd[838895]: Disconnected from invalid user developer 152.32.191.75 port 38708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:58:47 host2 sshd[840202]: Disconnected from invalid user marian 152.32.191.75 port 46460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 03:59:21 host2 sshd[840594]: Disconnected from invalid user sammy 198.98.57.141 port 44986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 20 03:59:59 host2 sshd[840997]: Disconnected from invalid user support 152.32.191.75 port 47736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:00:33 host2 sshd[841684]: Disconnected from invalid user marian 198.98.57.141 port 44120 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.178.110.228
country_id: 732800
description:
[2025-11-20 04:02:09 +0530] info [cpaneld] 195.178.110.228 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Nov 20 04:01:40 host2 sshd[842396]: Disconnected from invalid user admin 198.98.57.141 port 43256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:02:53 host2 sshd[843263]: Disconnected from invalid user mustafa 119.92.70.82 port 38358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.6.218.173
country_id: 3595528
description:
2025-11-20 04:05:43 dovecot_login authenticator failed for 173.218.6.200.static.intelnet.net.gt [200.6.218.173]:38045: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.131.165.45
country_id: 2661886
description:
2025-11-20 04:05:55 dovecot_login authenticator failed for ([88.131.165.45]) [88.131.165.45]:57084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov 20 04:05:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.91, session=<fvE7NPpD+oCUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:07:04 host2 sshd[848402]: Disconnected from invalid user dima 158.69.194.34 port 55670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:06:41 host2 sshd[847859]: Disconnected from invalid user admin 119.92.70.82 port 38436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:06:54 host2 sshd[848146]: Disconnected from invalid user support 134.209.225.104 port 59448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:06:57 host2 sshd[848211]: Disconnected from invalid user mustafa 203.161.184.246 port 15707 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:08:08 host2 sshd[849547]: Disconnected from invalid user support 158.69.194.34 port 50402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:08:15 host2 sshd[849697]: Disconnected from invalid user smith 101.36.108.134 port 56532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:07:19 host2 sshd[848618]: Disconnected from invalid user mt 103.244.91.128 port 52790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:07:48 host2 sshd[849114]: Disconnected from invalid user dima 139.59.66.39 port 45628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:08:57 host2 sshd[850627]: Disconnected from invalid user grace 77.192.248.233 port 59995 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:09:07 host2 sshd[850859]: Disconnected from invalid user stack 139.59.66.39 port 34708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:10:11 host2 sshd[852244]: Disconnected from invalid user guest 101.36.108.134 port 50716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:10:13 host2 sshd[852291]: Disconnected from invalid user scanner 134.209.225.104 port 43974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:11:03 host2 sshd[853616]: Disconnected from invalid user tobias 119.92.70.82 port 46150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.66.39
country_id: 1269750
description:
Nov 20 04:10:24 host2 sshd[852569]: Disconnected from invalid user sysadmin 139.59.66.39 port 54750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Nov 20 04:12:27 host2 sshd[855144]: Disconnected from invalid user reboot 158.69.194.34 port 44458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:13:07 host2 sshd[855690]: Disconnected from invalid user admin 205.185.125.150 port 51190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:12:40 host2 sshd[855242]: Disconnected from invalid user runner 119.92.70.82 port 48716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:12:54 host2 sshd[855401]: Disconnected from invalid user ubuntu 103.244.91.128 port 41816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:13:04 host2 sshd[855614]: Disconnected from invalid user tomcat 103.76.120.35 port 50536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.244.91.128
country_id: 1819730
description:
Nov 20 04:14:11 host2 sshd[856799]: Disconnected from invalid user tao 103.244.91.128 port 37466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:14:38 host2 sshd[857129]: Disconnected from invalid user smith 77.192.248.233 port 11787 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:14:28 host2 sshd[857018]: Disconnected from invalid user www 103.76.120.35 port 40668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.184.246
country_id: 1643084
description:
Nov 20 04:16:09 host2 sshd[858827]: Disconnected from invalid user tobias 203.161.184.246 port 44726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:15:40 host2 sshd[858340]: Disconnected from invalid user user01 101.36.108.134 port 47448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Nov 20 04:15:49 host2 sshd[858476]: Disconnected from invalid user newuser 119.92.70.82 port 53882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Nov 20 04:16:21 host2 sshd[859087]: Disconnected from invalid user myftp 134.209.225.104 port 41796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:16:59 host2 sshd[859682]: Disconnected from invalid user t 104.168.4.151 port 38552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 20 04:17:10 host2 sshd[859920]: Disconnected from invalid user tao 101.36.108.134 port 51376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:17:15 host2 sshd[860133]: Disconnected from invalid user qihang 103.76.120.35 port 45444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:16:43 host2 sshd[859406]: Disconnected from invalid user eacadm 205.185.125.150 port 50000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.192.248.233
country_id: 3017382
description:
Nov 20 04:18:00 host2 sshd[860795]: Disconnected from invalid user user01 77.192.248.233 port 53692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:18:35 host2 sshd[861315]: Disconnected from invalid user axel 205.185.125.150 port 49406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:20:14 host2 sshd[863166]: Disconnected from invalid user raccmcserver 104.168.4.151 port 38898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.34
country_id: 2510769
description:
Nov 20 04:19:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=139.28.190.34, lip=66.85.158.91, TLS, session=<4yHrY/pDnryLHL4i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.135
country_id: 3469034
description:
Nov 20 04:19:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.96.135, lip=66.85.158.91, TLS, session=<dWYCZfpDt8+/8GCH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.4.151
country_id: 6252001
description:
Nov 20 04:21:16 host2 sshd[864335]: Disconnected from invalid user magento 104.168.4.151 port 39010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Nov 20 04:22:24 host2 sshd[865436]: Disconnected from invalid user aaa 205.185.125.150 port 48218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.35
country_id: 1643084
description:
Nov 20 04:23:41 host2 sshd[868321]: Disconnected from invalid user magento 103.76.120.35 port 43806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-11-20 04:28:42 dovecot_login authenticator failed for ([37.211.94.35]) [37.211.94.35]:57074: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Nov 20 04:28:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.148, lip=66.85.158.92, TLS: Connection closed, session=<iOSxhfpDDpjHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-20 04:29:27 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1219: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-20 04:29:46 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:36085: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.252.27.223
country_id: 6252001
description:
Nov 20 04:29:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.252.27.223, lip=66.85.158.92, TLS: Connection closed, session=<uBq3ifpDWIMs/Bvf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-20 04:30:04 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:38041: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 04:30:50 host2 sshd[873118]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 04:32:17 host2 sshd[873913]: Disconnected from invalid user user 2.57.121.25 port 29236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-20 04:34:32 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:40204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.198
country_id: 6252001
description:
Nov 20 04:35:08 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.198, lip=66.85.158.92, session=<XmGWnPpD5h6s7OTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.185.98.251
country_id: 6252001
description:
2025-11-20 04:35:11 dovecot_login authenticator failed for (47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net) [47.185.98.251]:20076: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.216
country_id: 2395170
description:
Nov 20 04:36:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=154.127.36.216, lip=66.85.158.91, TLS, session=<fd55ofpDWOyafyTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.20
country_id: 99237
description:
Nov 20 04:37:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=65.20.136.20, lip=66.85.158.91, TLS, session=<5xGaovpDkrRBFIgU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:47:04 host2 sshd[882898]: Disconnected from invalid user ian 185.202.207.17 port 55310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov 20 04:47:48 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, session=<FJvpyfpDNJmsaAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.164
country_id: 6252001
description:
Nov 20 04:50:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lAf/0/pDpd7G6xik>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:51:13 host2 sshd[885219]: Disconnected from invalid user joel 66.96.239.187 port 46802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 04:51:38 host2 sshd[885492]: Disconnected from invalid user chen 103.123.227.244 port 38286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:52:31 host2 sshd[885933]: Disconnected from invalid user huake 66.96.239.187 port 33936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 20 04:54:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, session=<htm34PpDaMCUcdZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:55:04 host2 sshd[887895]: Disconnected from invalid user user 66.96.239.187 port 39148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 20 04:55:46 host2 sshd[888604]: Disconnected from invalid user huake 185.202.207.17 port 40306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:56:12 host2 sshd[888966]: Disconnected from invalid user gp 219.89.194.78 port 36890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 20 04:56:24 host2 sshd[889064]: Disconnected from invalid user deployer 66.96.239.187 port 33190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 04:57:50 host2 sshd[889810]: Disconnected from invalid user mm 219.89.194.78 port 44236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-20 04:58:55 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (auganhomia) [74.218.95.154]:50576: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.87.153
country_id: 6252001
description:
Nov 20 04:59:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.144.87.153, lip=66.85.158.91, TLS: Connection closed, session=<giYB8vpD9LoSkFeZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:01:17 host2 sshd[892082]: Disconnected from invalid user ob 103.123.227.244 port 53858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:02:57 host2 sshd[892934]: Disconnected from invalid user admin 219.89.194.78 port 60472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.86
country_id: 6252001
description:
Nov 20 05:04:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sI0CBftDL83N0h9W>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 05:06:12 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (paderimete) [81.225.30.107]:52337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:08:05 host2 sshd[896518]: Disconnected from invalid user iptv 103.123.227.244 port 37300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.89.194.78
country_id: 2186224
description:
Nov 20 05:08:22 host2 sshd[896660]: Disconnected from invalid user deployer 219.89.194.78 port 49330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:11:24 host2 sshd[898814]: Disconnected from invalid user eric 118.193.61.63 port 13634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.227.244
country_id: 1269750
description:
Nov 20 05:11:28 host2 sshd[898830]: Disconnected from invalid user maria 103.123.227.244 port 43904 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.100
country_id: 3017382
description:
Nov 20 05:11:32 host2 pure-ftpd[898882]: (?@91.196.152.100) [INFO] New connection from 91.196.152.100


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.102
country_id: 3017382
description:
Nov 20 05:11:34 host2 pure-ftpd[898895]: (?@91.196.152.102) [INFO] New connection from 91.196.152.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.34.116
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.254.34.116 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Nov 20 05:14:03 host2 sshd[900380]: Disconnected from invalid user info 118.193.61.63 port 13674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.85
country_id: 3865483
description:
Nov 20 05:15:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=181.225.195.85, lip=66.85.158.91, TLS, session=<S/egLPtDAc614cNV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.134
country_id: 933860
description:
Nov 20 05:16:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.134, lip=66.85.158.91, TLS, session=<qzrmLftD0Icp2NWG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:19:24 host2 sshd[903758]: Disconnected from invalid user ir 58.98.200.129 port 53014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:23:16 host2 sshd[906027]: Disconnected from invalid user st 103.153.110.189 port 36202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:25:03 host2 sshd[907499]: Disconnected from invalid user dtl 58.98.200.129 port 48606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:26:05 host2 sshd[908385]: Disconnected from invalid user yang 103.153.110.189 port 37724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:25:42 host2 sshd[908152]: Disconnected from invalid user ehsan 103.25.47.94 port 39872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:26:38 host2 sshd[908688]: Disconnected from invalid user ruben 162.214.126.1 port 59724 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Nov 20 05:27:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qnG0V/tDtMuTuYQ/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:27:33 host2 sshd[909216]: Disconnected from invalid user odoo 103.153.110.189 port 57788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 05:27:42 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:60571: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:27:59 host2 sshd[909457]: Disconnected from invalid user halley 103.25.47.94 port 45168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:30:16 host2 sshd[911160]: Disconnected from invalid user ehsan 162.214.126.1 port 58970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:30:34 host2 sshd[911313]: Disconnected from invalid user stepan 103.153.110.189 port 40552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.200.129
country_id: 1861060
description:
Nov 20 05:30:43 host2 sshd[911424]: Disconnected from invalid user gpu 58.98.200.129 port 53483 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-20 05:31:48 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:50704: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-20 05:31:20 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:47088: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:31:20 host2 sshd[911811]: Disconnected from invalid user ava 162.214.126.1 port 58732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:32:26 host2 sshd[912492]: Disconnected from invalid user sysop 162.214.126.1 port 58474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:32:45 host2 sshd[912701]: Disconnected from invalid user gast 103.25.47.94 port 47068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov 20 05:33:43 host2 sshd[913146]: Disconnected from invalid user valheim 103.153.110.189 port 57264 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 05:33:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pards) [87.103.126.54]:42292: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Nov 20 05:33:34 host2 sshd[913097]: Disconnected from invalid user csadmin 162.214.126.1 port 58228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.77
country_id: 2186224
description:
2025-11-20 05:34:50 dovecot_login authenticator failed for ([121.73.169.77]) [121.73.169.77]:45108: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-20 05:34:34 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:40236: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:35:58 host2 sshd[915270]: Disconnected from invalid user aso 103.25.47.94 port 48326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Nov 20 05:37:30 host2 sshd[916185]: Disconnected from invalid user tester 103.25.47.94 port 48946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.53.194.185
country_id: 2661886
description:
2025-11-20 05:38:48 dovecot_plain authenticator failed for ec2-13-53-194-185.eu-north-1.compute.amazonaws.com (EC2AMAZ-9MJPURA.eu-north-1.compute.internal) [13.53.194.185]:60486: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.28.201
country_id: 3469034
description:
Nov 20 05:39:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.152.28.201, lip=66.85.158.91, TLS, session=<kBDMgPtDR8yxmBzJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.108
country_id: 1269750
description:
Nov 20 05:39:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.237.58.108, lip=66.85.158.91, TLS, session=<AGcEgvtDIOdn7Tps>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 20 05:41:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QHaHiPtDWENChJl6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 20 05:43:58 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.91, TLS, session=<YnPHkvtDNI1HBobo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.40.205
country_id: 1819730
description:
Nov 20 05:49:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.40.205, lip=66.85.158.91, session=<3rXVpPtDmt+lmijN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.40.205
country_id: 1819730
description:
Nov 20 05:49:02 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.40.205, lip=66.85.158.91, TLS, session=<kIHjpPtDquClmijN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.72
country_id: 2635167
description:
Nov 20 05:49:07 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS, session=<VZMypftDB4C594lI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 05:49:53 host2 sshd[925048]: Disconnected from invalid user martina 62.60.131.157 port 61384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 05:54:15 host2 sshd[928268]: Disconnected from invalid user user 2.57.121.25 port 53594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov 20 06:03:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS: Connection closed, session=<xiR11/tDlOxChJlw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.43.53
country_id: 2921044
description:
Nov 20 06:17:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.211.43.53, lip=66.85.158.91, session=<DuxWCfxDyJII0ys1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 136.169.114.247
country_id: 458258
description:
Nov 20 06:18:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=136.169.114.247, lip=66.85.158.91, TLS, session=<pNIwDfxDu7KIqXL3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.2
country_id: 3469034
description:
Nov 20 06:18:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.137.2, lip=66.85.158.91, TLS, session=<VThYDvxDU+2+WYkC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-20 06:19:53 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:58622: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 06:19:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61242: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-20 06:19:38 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:34252: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.31
country_id: 6252001
description:
Nov 20 06:22:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.31, lip=66.85.158.92, TLS, session=<+LNdHfxDpPuTuYQf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 06:25:10 host2 sshd[950982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.179
country_id: 6252001
description:
Nov 20 06:25:33 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.182.179, lip=66.85.158.92, session=<+zh+J/xDns6lmraz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 20 06:25:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<gf0IJ/xDyr5HBpK6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.179
country_id: 6252001
description:
Nov 20 06:26:44 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.182.179, lip=66.85.158.91, session=<8lC0K/xD0r6lmraz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.51.234.233
country_id: 6252001
description:
Nov 20 06:27:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.51.234.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MB9WLfxDiNIUM+rp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.102.16.171
country_id: 3469034
description:
Nov 20 06:43:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.102.16.171, lip=66.85.158.91, TLS, session=<MW8KZ/xDBre7ZhCr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.233.77
country_id: 1694008
description:
Nov 20 06:43:44 host2 sshd[962229]: Connection reset by invalid user test 165.154.233.77 port 39598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.196
country_id: 3865483
description:
Nov 20 06:44:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=186.190.167.196, lip=66.85.158.91, TLS, session=<k7qFaPxDl7G6vqfE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 06:47:58 host2 sshd[965388]: Disconnected from invalid user martina 62.60.131.157 port 11912 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.130.197.3
country_id: 798544
description:
Nov 20 06:52:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=195.130.197.3, lip=66.85.158.91, TLS, session=<Hnk/h/xD1r3DgsUD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.196
country_id: 3996063
description:
Nov 20 06:52:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=138.122.97.196, lip=66.85.158.91, TLS, session=<lVRTiPxDzYKKemHE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 06:54:51 host2 sshd[970521]: Disconnected from invalid user user 2.57.121.25 port 21351 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 07:07:11 host2 sshd[978811]: Disconnected from invalid user maryam 62.60.131.157 port 24146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.75
country_id: 3865483
description:
Nov 20 07:13:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=200.229.252.75, lip=66.85.158.91, TLS, session=<hnNo0/xDdbLI5fxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.86.63
country_id: 732800
description:
Nov 20 07:14:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.107.86.63, lip=66.85.158.91, TLS, session=<1saj1PxDeNJta1Y/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.40
country_id: 3469034
description:
Nov 20 07:15:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.224.97.40, lip=66.85.158.91, TLS, session=<o3062fxDbei64GEo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.179
country_id: 3865483
description:
Nov 20 07:15:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=190.122.128.179, lip=66.85.158.91, TLS, session=<SoGA2vxD/8q+eoCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-20 07:16:39 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:54806: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-20 07:16:48 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:65191: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:24:09 host2 sshd[988402]: Disconnected from invalid user admin 107.174.82.236 port 48262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-20 07:25:18 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (spurocces) [73.195.211.98]:55964: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:25:08 host2 sshd[989105]: Disconnected from invalid user sunil 107.174.82.236 port 40086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:26:10 host2 sshd[990101]: Disconnected from invalid user roo 107.174.82.236 port 35408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.82.236
country_id: 6252001
description:
Nov 20 07:28:07 host2 sshd[991575]: Disconnected from invalid user rdp 107.174.82.236 port 50348 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.234.28.194
country_id: 1643084
description:
[2025-11-20 07:30:48 +0530] info [whostmgrd] 103.234.28.194 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.76
country_id: 3469034
description:
Nov 20 07:43:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.216.88.76, lip=66.85.158.91, TLS, session=<OYcnPP1DmM662FhM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.56
country_id: 3469034
description:
Nov 20 07:43:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=186.209.249.56, lip=66.85.158.91, TLS, session=<DoWNPf1DkqW60fk4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 07:44:16 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:50654: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:50:38 host2 sshd[1005264]: Disconnected from invalid user front-user 177.85.247.230 port 31368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.137
country_id: 1880251
description:
Nov 20 07:51:10 host2 sshd[1005555]: Disconnected from invalid user azureuser 157.245.55.137 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:52:54 host2 sshd[1006566]: Disconnected from invalid user suporte 177.85.247.230 port 17110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-20 07:54:03 dovecot_plain authenticator failed for (minen) [91.73.195.150]:40636: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.55.137
country_id: 1880251
description:
Nov 20 07:54:30 host2 sshd[1007944]: Disconnected from invalid user front-user 157.245.55.137 port 58262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.227
country_id: 6252001
description:
Nov 20 07:55:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.227, lip=66.85.158.92, session=<9MqgaP1DOOHG6xjj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 07:57:14 host2 sshd[1010038]: Disconnected from invalid user dylan 177.85.247.230 port 53266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Nov 20 08:01:21 host2 sshd[1013099]: Disconnected from invalid user app 177.85.247.230 port 40648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.97
country_id: 298795
description:
Nov 20 08:02:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=95.0.171.97, lip=66.85.158.91, TLS, session=<b5hngf1DyKBfAKth>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 20 08:02:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<ZHUVg/1D8oOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.248.74.236
country_id: 2363686
description:
Nov 20 08:02:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=80.248.74.236, lip=66.85.158.91, TLS, session=<E1OBgv1DK79Q+Ers>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:10:24 host2 sshd[1020312]: Disconnected from invalid user user1 186.96.151.198 port 36058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.156
country_id: 1880251
description:
Nov 20 08:15:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=15.235.189.156, lip=66.85.158.92, session=<Du7Rr/1Dg80P672c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:15:15 host2 sshd[1024478]: Disconnected from invalid user admin 186.96.151.198 port 43608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 20 08:19:31 host2 sshd[1027035]: Disconnected from invalid user admin 186.96.151.198 port 37226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:19:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1qHsv/1D09Mjy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:20:06 host2 sshd[1027609]: Disconnected from invalid user user1 91.240.15.18 port 36818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:20:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nXtMxP1DbOgjy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.114
country_id: 1643084
description:
Nov 20 08:21:24 host2 sshd[1028452]: Disconnected from invalid user netbox 203.145.34.114 port 49452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:21:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<YTvMxP1D8O4jy9IN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 08:23:47 host2 sshd[1029828]: Disconnected from invalid user dimitri 62.60.131.157 port 58774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Nov 20 08:24:07 host2 sshd[1029936]: Disconnected from invalid user vbox 45.78.228.110 port 36254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:24:35 host2 sshd[1030347]: Disconnected from invalid user ubuntu 91.240.15.18 port 46194 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.13
country_id: 2635167
description:
Nov 20 08:27:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.13, lip=66.85.158.91, TLS, session=<P7iN3P1DFOgjy9IN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2025-11-20 08:31:24 dovecot_login authenticator failed for (Copy-of-VM-2022) [45.94.31.41]:41555: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 20 08:31:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yMM86v1DNtK58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-20 08:31:39 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:54622: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-20 08:31:56 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:55054: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 20 08:32:00 host2 sshd[1035321]: Disconnected from invalid user allan 91.240.15.18 port 51972 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.70.56
country_id: 2750405
description:
Nov 20 08:32:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.227.70.56, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FvPO6/1DEpNA40Y4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-20 08:31:23 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:40512: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 08:34:12 host2 sshd[1036688]: Disconnected from invalid user user 2.57.121.25 port 18658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-20 08:34:24 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:34507: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-20 08:34:41 dovecot_login authenticator failed for ([122.187.229.194]) [122.187.229.194]:40388: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.229
country_id: 6252001
description:
Nov 20 08:35:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<F0oN9/1Dks/N0h/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:36:57 host2 sshd[1038615]: Disconnected from invalid user bpuser 190.207.47.141 port 43544 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 20 08:37:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2rlB//1D4Lq58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.153.174.18
country_id: 298795
description:
Nov 20 08:39:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=213.153.174.18, lip=66.85.158.91, TLS, session=<EoTKBf5DrbTVma4S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.141
country_id: 3175395
description:
Nov 20 08:39:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art>, method=PLAIN, rip=185.63.132.141, lip=66.85.158.91, TLS, session=<bkzfBv5D2Iy5P4SN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:41:03 host2 sshd[1041481]: Disconnected from invalid user support 190.207.47.141 port 59126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:42:19 host2 sshd[1042276]: Disconnected from invalid user admin 190.207.47.141 port 54830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:42:30 host2 sshd[1042386]: Disconnected from invalid user x 103.4.145.49 port 33636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:43:38 host2 sshd[1043054]: Disconnected from invalid user x 190.207.47.141 port 45164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.207.47.141
country_id: 3625428
description:
Nov 20 08:44:56 host2 sshd[1043998]: Disconnected from invalid user cs 190.207.47.141 port 59386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:45:30 host2 sshd[1045337]: Disconnected from invalid user bpuser 103.4.145.49 port 34766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.49
country_id: 1210997
description:
Nov 20 08:46:53 host2 sshd[1047356]: Disconnected from invalid user mahsa 103.4.145.49 port 35324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:55:20 host2 sshd[1053231]: Disconnected from invalid user simon 83.49.192.37 port 40406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:58:42 host2 sshd[1055544]: Disconnected from invalid user cuser 83.49.192.37 port 48978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 08:59:36 host2 sshd[1056002]: Disconnected from invalid user adminftp 139.59.64.179 port 47820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 08:59:52 host2 sshd[1056178]: Disconnected from invalid user user 83.49.192.37 port 45242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.203
country_id: 3469034
description:
Nov 20 09:01:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.96.203, lip=66.85.158.91, TLS, session=<JAB1Uv5DyeS/8GDL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.58
country_id: 3865483
description:
Nov 20 09:00:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=179.0.249.58, lip=66.85.158.91, TLS, session=<Vr8kUf5DScqzAPk6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:00:57 host2 sshd[1057043]: Disconnected from invalid user ubuntu 139.59.64.179 port 49844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.49.192.37
country_id: 2510769
description:
Nov 20 09:00:59 host2 sshd[1057062]: Disconnected from invalid user alex 83.49.192.37 port 41552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:03:32 host2 sshd[1058990]: Disconnected from invalid user mas 139.59.64.179 port 53884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.141
country_id: 6252001
description:
Nov 20 09:04:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.141, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SwmzXv5DAows3LmN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 20 09:04:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: Connection closed, session=<0Y6YYP5D4jtChJmA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 20 09:06:07 host2 sshd[1060731]: Disconnected from invalid user icp 139.59.64.179 port 57926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.110
country_id: 1880251
description:
Nov 20 09:10:15 host2 sshd[1063475]: Disconnected from invalid user user 45.78.228.110 port 42628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-11-20 09:13:07 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:59290: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-20 09:12:36 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:49488: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-20 09:16:34 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:42207: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-20 09:16:19 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:39510: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:18:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<4ROjkf5DA9Gi2JYU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:19:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<TWIvlf5DlOCi2JYU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:21:46 host2 sshd[1071123]: Disconnected from invalid user julius 54.39.165.17 port 33452 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.20
country_id: 6252001
description:
Nov 20 09:24:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.20, lip=66.85.158.92, TLS, session=<eze+p/5DDOmi2JYU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:24:45 host2 sshd[1073069]: Disconnected from invalid user felix 54.39.165.17 port 42506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:24:51 host2 sshd[1073122]: Disconnected from invalid user backupuser 37.187.244.59 port 47760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.39.165.17
country_id: 6251999
description:
Nov 20 09:25:54 host2 sshd[1073872]: Disconnected from invalid user opsadmin 54.39.165.17 port 53090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-20 09:26:07 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:35464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-20 09:26:41 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:29:29 host2 sshd[1076061]: Disconnected from invalid user user1 37.187.244.59 port 44830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.187.244.59
country_id: 3017382
description:
Nov 20 09:30:34 host2 sshd[1076883]: Disconnected from invalid user ftpuser 37.187.244.59 port 53196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.210
country_id: 2300660
description:
Nov 20 09:40:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=41.139.5.210, lip=66.85.158.91, TLS, session=<mvSs3f5Dxr0piwXS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.194
country_id: 953987
description:
Nov 20 09:40:23 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.129.57.194, lip=66.85.158.91, TLS, session=<ADcQ3/5D/rhmgTnC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:45:29 host2 sshd[1088145]: Disconnected from invalid user lab 195.250.72.168 port 53474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:47:50 host2 sshd[1090348]: Disconnected from invalid user rf 64.227.160.133 port 57416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:47:54 host2 sshd[1090406]: Disconnected from invalid user test11 69.51.217.189 port 34284 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.148.26.145
country_id: 2802361
description:
Nov 20 09:48:47 host2 pure-ftpd[1091120]: (?@146.148.26.145) [INFO] New connection from 146.148.26.145


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:49:13 host2 sshd[1091481]: Disconnected from invalid user ubuntu 64.227.160.133 port 46448 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 09:51:18 host2 sshd[1093141]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 09:51:15 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:51:17 host2 sshd[1093129]: Disconnected from invalid user vinicius 69.51.217.189 port 44664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.63
country_id: 719819
description:
Nov 20 09:52:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.48.181.63, lip=66.85.158.91, TLS, session=<JG5DC/9DBr6yMLU/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 20 09:52:55 host2 sshd[1094112]: Disconnected from invalid user user 2.57.121.25 port 31221 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.164
country_id: 3469034
description:
Nov 20 09:53:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.209.247.164, lip=66.85.158.91, TLS, session=<eVBfDP9DTu260fek>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:53:27 host2 sshd[1094520]: Disconnected from invalid user tom 69.51.217.189 port 52236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-11-20 09:53:36 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:57828: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-20 09:53:59 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:51190: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:54:14 host2 sshd[1095160]: Disconnected from invalid user git 195.250.72.168 port 46664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.51.217.189
country_id: 6251999
description:
Nov 20 09:54:35 host2 sshd[1095771]: Disconnected from invalid user odoo 69.51.217.189 port 60990 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.112.83
country_id: 3469034
description:
Nov 20 09:56:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=187.120.112.83, lip=66.85.158.91, TLS, session=<lZSJGP9D7NC7eHBT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:56:36 host2 sshd[1097381]: Disconnected from invalid user odoo 195.250.72.168 port 41576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Nov 20 09:56:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<tyTPGf9DJ68p2NeO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:57:49 host2 sshd[1098137]: Disconnected from invalid user ftpadmin 195.250.72.168 port 43640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.133
country_id: 1269750
description:
Nov 20 09:58:08 host2 sshd[1098355]: Disconnected from invalid user steamcmd 64.227.160.133 port 47442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.250.72.168
country_id: 174982
description:
Nov 20 09:58:57 host2 sshd[1098883]: Disconnected from invalid user vinicius 195.250.72.168 port 33494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:19:24 host2 sshd[1114223]: Disconnected from invalid user backend 138.124.20.112 port 42900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:19:28 host2 sshd[1114261]: Disconnected from invalid user vncuser 202.60.231.203 port 35984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.248
country_id: 6252001
description:
Nov 20 10:21:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.248, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iCrmc/9DWdbN0h/4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-20 10:22:44 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1148: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-20 10:22:57 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:32782: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:23:15 host2 sshd[1117113]: Disconnected from invalid user daisy 138.124.20.112 port 53614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:23:47 host2 sshd[1117388]: Disconnected from invalid user admin 202.60.231.203 port 42016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.60.231.203
country_id: 1819730
description:
Nov 20 10:28:04 host2 sshd[1120220]: Disconnected from invalid user dev 202.60.231.203 port 48052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:29:00 host2 sshd[1120694]: Disconnected from invalid user alex 138.124.20.112 port 34044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.20.112
country_id: 798544
description:
Nov 20 10:30:03 host2 sshd[1121412]: Disconnected from invalid user base 138.124.20.112 port 57166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:30:12 host2 sshd[1121591]: Disconnected from invalid user jenkins 64.226.100.148 port 59022 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.0.149
country_id: 2215636
description:
Nov 20 10:33:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=5.63.0.149, lip=66.85.158.91, TLS, session=<WE+inv9DnpwFPwCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.72
country_id: 2510769
description:
Nov 20 10:34:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.229.98.72, lip=66.85.158.91, TLS, session=<HrhIoP9DtbO55WJI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.59
country_id: 3469034
description:
Nov 20 10:35:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=187.120.104.59, lip=66.85.158.91, TLS, session=<Cj2Cpf9DCN+7eGg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.85
country_id: 732800
description:
Nov 20 10:35:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.253.159.85, lip=66.85.158.91, TLS, session=<VzxmpP9Da+y5/Z9V>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:35:42 host2 sshd[1125181]: Disconnected from invalid user backend 64.226.100.148 port 47040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.217
country_id: 6252001
description:
Nov 20 10:40:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.217, lip=66.85.158.92, TLS, session=<m9+yuP9Dmv3N0h/Z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:41:08 host2 sshd[1128799]: Disconnected from invalid user sftp_user 64.226.100.148 port 41736 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 20 10:42:10 host2 sshd[1129339]: Disconnecting authenticating user root 173.24.18.140 port 37678: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Nov 20 10:42:10 host2 sshd[1129339]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 37678 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:50:07 host2 sshd[1134724]: Disconnected from invalid user vivek 20.203.42.204 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Nov 20 10:50:10 host2 sshd[1134817]: Disconnected from invalid user github 64.226.100.148 port 45094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 10:50:34 host2 sshd[1135145]: Disconnected from invalid user admin 152.200.205.179 port 55896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:51:59 host2 sshd[1135872]: Disconnected from invalid user admin 54.38.79.136 port 60026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:53:18 host2 sshd[1136610]: Disconnected from invalid user vivek 83.215.13.5 port 60424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:53:20 host2 sshd[1136675]: Disconnected from invalid user oliver 103.245.231.184 port 44930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 10:53:45 host2 sshd[1136846]: Disconnected from invalid user zakary 62.60.131.157 port 8798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:53:10 host2 sshd[1136526]: Disconnected from invalid user rbs 54.38.79.136 port 60640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:54:34 host2 sshd[1137767]: Disconnected from invalid user a 83.215.13.5 port 52926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:54:25 host2 sshd[1137698]: Disconnected from invalid user fmanager 103.245.231.184 port 37360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 10:55:28 host2 sshd[1138570]: Disconnected from invalid user oliver 152.200.205.179 port 48796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:55:47 host2 sshd[1138828]: Disconnected from invalid user bryan 83.215.13.5 port 38866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:55:27 host2 sshd[1138563]: Disconnected from invalid user bryan 103.245.231.184 port 45420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.245.231.184
country_id: 2750405
description:
Nov 20 10:56:30 host2 sshd[1139352]: Disconnected from invalid user admin 103.245.231.184 port 33230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 10:56:58 host2 sshd[1139642]: Disconnected from invalid user oliver 83.215.13.5 port 42568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.79.136
country_id: 2635167
description:
Nov 20 10:56:22 host2 sshd[1139239]: Disconnected from invalid user vivek 54.38.79.136 port 46336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:57:58 host2 sshd[1140249]: Disconnected from invalid user fmanager 20.203.42.204 port 44404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Nov 20 10:59:39 host2 sshd[1141074]: Disconnected from invalid user adminer 20.203.42.204 port 38328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.70.183
country_id: 6252001
description:
Nov 20 11:00:05 host2 sshd[1141466]: Disconnected from invalid user polls 74.48.70.183 port 57650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:01:03 host2 sshd[1142144]: Disconnecting invalid user admin 5.187.97.40 port 43239: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.215.13.5
country_id: 2782113
description:
Nov 20 11:00:44 host2 sshd[1141941]: Disconnected from invalid user staging 83.215.13.5 port 58006 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:00:57 host2 sshd[1142048]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 42629 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 20 11:00:57 host2 sshd[1142048]: Disconnecting authenticating user root 5.187.97.40 port 42629: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.138
country_id: 3175395
description:
Nov 20 11:02:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.139.180.138, lip=66.85.158.91, TLS, session=<O8JLBgBELoi5i7SK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.132
country_id: 1269750
description:
Nov 20 11:03:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=103.8.118.132, lip=66.85.158.91, TLS, session=<cRl3BwBEBLZnCHaE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 11:03:15 host2 sshd[1143922]: Disconnected from invalid user a 152.200.205.179 port 59420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.205.179
country_id: 3686110
description:
Nov 20 11:04:34 host2 sshd[1144650]: Disconnected from invalid user bryan 152.200.205.179 port 39050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.70.183
country_id: 6252001
description:
Nov 20 11:06:12 host2 sshd[1145757]: Disconnected from invalid user adminer 74.48.70.183 port 60216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.27
country_id: 2510769
description:
Nov 20 11:10:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.214.138.27, lip=66.85.158.91, TLS, session=<8eiXIQBEc6+51oob>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.176
country_id: 3077311
description:
Nov 20 11:10:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=85.163.38.176, lip=66.85.158.91, TLS, session=<tFivIgBEKKpVoyaw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 20 11:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<QQVEKABEmLKLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.83.104.113
country_id: 1814991
description:
2025-11-20 11:13:18 dovecot_login authenticator failed for (ntY38njAkz) [49.83.104.113]:51055: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.83.104.113
country_id: 1814991
description:
2025-11-20 11:14:10 dovecot_login authenticator failed for (kaPwn3DR5) [49.83.104.113]:51554: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-20 11:15:26 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:39584: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-20 11:15:57 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:56328: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.141.90
country_id: 690791
description:
Nov 20 11:25:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=37.221.141.90, lip=66.85.158.91, TLS, session=<IGIyVwBEAZAl3Y1a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.189
country_id: 3469034
description:
Nov 20 11:25:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.189, lip=66.85.158.91, TLS, session=<VNVXWABEBqixLGC9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.115
country_id: 6252001
description:
Nov 20 11:28:43 host2 pure-ftpd[1160552]: (?@199.45.154.115) [INFO] New connection from 199.45.154.115


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:30:50 host2 sshd[1161912]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:40:05 host2 sshd[1168202]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:39:16 host2 sshd[1167494]: Disconnected from invalid user one 43.163.123.45 port 46622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:42:18 host2 sshd[1170227]: Disconnected from invalid user ubuntu 43.163.123.45 port 52796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:44:06 host2 sshd[1171657]: Disconnected from invalid user git 194.107.115.199 port 19747 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:43:58 host2 sshd[1171518]: Disconnected from invalid user paul 34.22.66.183 port 44632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-20 11:44:00 dovecot_plain authenticator failed for (plousionci) [24.93.140.162]:43403: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:45:36 host2 sshd[1173431]: Disconnected from invalid user gilbert 194.107.115.199 port 34956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:45:49 host2 sshd[1173697]: Disconnected from invalid user bogdan 116.193.191.159 port 37834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 20 11:47:03 host2 sshd[1174542]: Disconnected from invalid user hlw 194.107.115.199 port 50161 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:47:43 host2 sshd[1174994]: Disconnected from invalid user henry 34.22.66.183 port 60196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:48:08 host2 sshd[1175343]: Disconnected from invalid user happy 192.210.233.234 port 55310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 11:48:13 host2 sshd[1175411]: Disconnected from invalid user cisco 170.238.160.191 port 40470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:48:57 host2 sshd[1175875]: Disconnected from invalid user usuario2 34.22.66.183 port 54580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:49:47 host2 sshd[1176532]: Disconnected from invalid user upload 116.193.191.159 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 11:49:13 host2 sshd[1176106]: Disconnected from invalid user zakary 62.60.131.157 port 10020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 11:50:56 host2 sshd[1177562]: Disconnected from invalid user yf 170.238.160.191 port 52794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:51:05 host2 sshd[1177731]: Disconnected from invalid user sina 192.210.233.234 port 46616 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:50:15 host2 sshd[1177115]: Disconnected from invalid user git 34.22.66.183 port 35154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:50:32 host2 sshd[1177317]: Disconnected from invalid user db 134.209.101.17 port 46260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:51:13 host2 sshd[1177790]: Disconnected from invalid user tecnica 116.193.191.159 port 46346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.22.66.183
country_id: 1835841
description:
Nov 20 11:51:31 host2 sshd[1177943]: Disconnected from invalid user ftp_user 34.22.66.183 port 48264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 20 11:52:32 host2 sshd[1178854]: Disconnected from invalid user maman 43.163.123.45 port 46114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 11:52:51 host2 sshd[1179117]: Disconnected from invalid user ryan 64.226.96.54 port 43282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:53:22 host2 sshd[1179589]: Disconnected from invalid user nima 192.210.233.234 port 40438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 20 11:53:14 host2 sshd[1179484]: Disconnected from invalid user yf 144.48.8.10 port 59798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:53:20 host2 sshd[1179567]: Disconnected from invalid user code 134.209.101.17 port 38762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:53:44 host2 sshd[1179855]: Disconnected from invalid user payroll 36.95.194.54 port 55502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 20 11:53:51 host2 sshd[1179934]: Disconnected from invalid user rashid 116.193.191.159 port 40664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-11-20 11:54:09 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (pates) [82.32.230.230]:44337: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Nov 20 11:55:53 host2 sshd[1182587]: Disconnected from invalid user cisco 192.210.233.234 port 45122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:56:46 host2 sshd[1183231]: Disconnected from invalid user git 36.95.194.54 port 58642 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 11:59:06 host2 sshd[1184460]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:58:35 host2 sshd[1184322]: Disconnected from invalid user marek 134.209.101.17 port 56350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.130.79
country_id: 2077456
description:
2025-11-20 11:58:57 dovecot_login authenticator failed for ([120.157.130.79]) [120.157.130.79]:44026: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 11:59:53 host2 sshd[1185031]: Disconnected from invalid user linuxadmin 36.95.194.54 port 54262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-20 11:59:33 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:34373: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.238.160.191
country_id: 3469034
description:
Nov 20 12:00:00 host2 sshd[1185081]: Disconnected from invalid user ssd 170.238.160.191 port 42146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.38
country_id: 1269750
description:
2025-11-20 11:59:19 dovecot_login authenticator failed for ([182.79.35.233]) [128.185.215.38]:59700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.101.17
country_id: 1880251
description:
Nov 20 11:59:52 host2 sshd[1185017]: Disconnected from invalid user ryan 134.209.101.17 port 41180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 12:00:10 host2 sshd[1185411]: Disconnected from invalid user sina 64.226.96.54 port 38440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.30.161.197
country_id: 690791
description:
Nov 20 12:02:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng>, method=PLAIN, rip=46.30.161.197, lip=66.85.158.91, session=<5F6N3QBEq78uHqHF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.159.164.28
country_id: 294640
description:
Nov 20 12:02:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=85.159.164.28, lip=66.85.158.91, TLS, session=<8jz12wBEQdBVn6Qc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.255.202.56
country_id: 2413451
description:
Nov 20 12:03:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=197.255.202.56, lip=66.85.158.91, TLS, session=<X9rT3QBEwcLF/8o4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.96.54
country_id: 2921044
description:
Nov 20 12:04:33 host2 sshd[1188403]: Disconnected from invalid user ssd 64.226.96.54 port 59184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:05:18 host2 sshd[1188955]: Disconnected from invalid user vadim 138.68.97.135 port 55424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 20 12:06:36 host2 sshd[1189601]: Disconnected from invalid user debian 36.95.194.54 port 36464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:07:10 host2 sshd[1190000]: Disconnected from invalid user user 36.67.70.198 port 60910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:09:43 host2 sshd[1191478]: Disconnected from invalid user sgd 36.67.70.198 port 56444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:11:04 host2 sshd[1192485]: Disconnected from invalid user dev 138.68.97.135 port 56776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-20 12:11:00 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:54745: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-20 12:11:37 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:47058: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.208.85
country_id: 798544
description:
Nov 20 12:11:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.246.208.85, lip=66.85.158.91, TLS, session=<26Vp/QBE/Jdb9tBV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:11:20 host2 sshd[1192605]: Disconnected from invalid user code 36.67.70.198 port 54798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:13:06 host2 sshd[1193802]: Disconnected from invalid user user 138.68.97.135 port 45320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.97.135
country_id: 2921044
description:
Nov 20 12:14:10 host2 sshd[1194576]: Disconnected from invalid user sgd 138.68.97.135 port 35508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Nov 20 12:14:42 host2 sshd[1194853]: Disconnected from invalid user odoo 36.67.70.198 port 59004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-20 12:15:54 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:56274: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-20 12:16:15 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:46525: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:17:09 host2 sshd[1196288]: Disconnected from invalid user ftpuser 181.23.52.22 port 51786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-20 12:23:00 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (hytionts) [73.13.220.220]:45042: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:24:15 host2 sshd[1200366]: Disconnected from invalid user light 181.23.52.22 port 56264 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.23.52.22
country_id: 3865483
description:
Nov 20 12:27:50 host2 sshd[1202504]: Disconnected from invalid user es 181.23.52.22 port 58720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov 20 12:36:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<2bV8VgFEQLbJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.252.229.77
country_id: 3865483
description:
Nov 20 12:37:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=201.252.229.77, lip=66.85.158.91, TLS, session=<NE63VwFEX6TJ/OVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.221
country_id: 6252001
description:
Nov 20 12:39:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Yy2SXwFEN8XN0h/d>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 12:50:35 host2 sshd[1219004]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.177.100
country_id: 3469034
description:
Nov 20 12:52:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=200.77.177.100, lip=66.85.158.91, TLS, session=<fdIgjgFEmZDITbFk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.174
country_id: 953987
description:
Nov 20 12:52:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=102.64.32.174, lip=66.85.158.91, TLS, session=<boZkjwFETs1mQCCu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
country_id: 6252001
description:
2025-11-20 12:59:24 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:36274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 13:02:53 host2 sshd[1227145]: Disconnected from invalid user jazmyne 62.60.131.157 port 25736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-20 13:07:41 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:51804: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Nov 20 13:07:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dR9oxgFE09HG6xh3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-11-20 13:07:17 dovecot_login authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:52248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:11:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<bnfE0QFEPIcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:11:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zewu1AFE1r0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:12:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9bpk1QFEfL8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:13:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4iW42QFEPpEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:14:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QBif3AFEqL4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:15:07 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<V/ww4AFEssQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:16:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qZmm5AFEtIkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:17:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DbbY6AFEMMUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:18:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R9Ca6wFEytcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 20 13:19:35 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<4DAy8AFEAKoDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-11-20 13:30:04 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:35186: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-20 13:30:30 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:60136: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.198
country_id: 3865483
description:
Nov 20 13:33:42 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=186.190.167.198, lip=66.85.158.91, TLS, session=<2dqUIQJE+Ku6vqfG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.41
country_id: 99237
description:
Nov 20 13:34:01 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.136.41, lip=66.85.158.91, TLS, session=<jc3HIgJEyIdBFIgp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 13:37:31 host2 sshd[1249143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.18
country_id: 226074
description:
Nov 20 13:40:57 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training@v-deploy.com>, method=PLAIN, rip=196.0.87.18, lip=66.85.158.91, TLS, session=<MKdYOwJE0c/EAFcS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.235
country_id: 298795
description:
Nov 20 13:41:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=45.67.155.235, lip=66.85.158.91, TLS, session=<DsarPAJEBs8tQ5vr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 13:41:39 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53506: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.116
country_id: 3865483
description:
Nov 20 13:54:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=138.0.184.116, lip=66.85.158.91, TLS, session=<avcSawJEHayKALh0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.177
country_id: 3469034
description:
Nov 20 13:54:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.36.202.177, lip=66.85.158.91, TLS, session=<d8ZdbAJEK8aKJMqx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.215
country_id: 3175395
description:
Nov 20 13:55:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=217.26.179.215, lip=66.85.158.91, TLS, session=<PlLEcAJEApLZGrPX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.196.139
country_id: 3865483
description:
Nov 20 13:56:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.96.196.139, lip=66.85.158.91, TLS, session=<SFrtcQJERqS6YMSL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 13:59:44 dovecot_login authenticator failed for (eBEH3Pw) [213.209.157.174]:63741: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 14:00:07 dovecot_login authenticator failed for (0iLzhX) [213.209.157.174]:60927: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-20 14:01:17 dovecot_login authenticator failed for (6CfsuDeSZ5) [213.209.157.174]:62864: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 20 14:01:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<g1SehgJE9oWLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Nov 20 14:03:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.70, lip=66.85.158.91, TLS, session=<BUj6iwJEsPmTuYRG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-20 14:04:12 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (boophated) [98.40.101.10]:47316: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.121.215
country_id: 2802361
description:
Nov 20 14:12:00 host2 pure-ftpd[1272910]: (?@35.240.121.215) [INFO] New connection from 35.240.121.215


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.130.33
country_id: 99237
description:
Nov 20 14:23:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=65.20.130.33, lip=66.85.158.91, TLS, session=<XoA10wJEHotBFIIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.222
country_id: 2300660
description:
Nov 20 14:23:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=41.139.18.222, lip=66.85.158.91, TLS, session=</Pp/1AJEbeIpixLe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:24:33 host2 sshd[1279843]: Disconnected from invalid user test 51.158.120.121 port 36654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:25:41 dovecot_login authenticator failed for (pkm3is) [121.237.41.41]:56400: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 20 14:25:13 host2 sshd[1280308]: Disconnected from invalid user stack 107.175.159.248 port 44720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:25:31 host2 sshd[1280497]: Disconnected from invalid user amir 51.158.120.121 port 42432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:26:07 dovecot_login authenticator failed for (wlo2fnd) [121.237.41.41]:56591: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.237.41.41
country_id: 1814991
description:
2025-11-20 14:27:20 dovecot_login authenticator failed for (GHxzN26NE6) [121.237.41.41]:57580: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Nov 20 14:29:46 host2 sshd[1283061]: Disconnected from invalid user runner 51.158.120.121 port 42416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 20 14:31:35 host2 sshd[1284110]: Disconnected from invalid user abbas 107.175.159.248 port 45016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:37:47 host2 sshd[1287873]: Disconnected from invalid user saga 52.169.142.214 port 58138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:39:37 host2 sshd[1288924]: Disconnected from invalid user admin 52.169.142.214 port 53000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:40:28 host2 sshd[1289521]: Disconnected from invalid user admin 185.77.225.203 port 46152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 14:40:55 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:57702: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:42:02 host2 sshd[1290349]: Disconnected from invalid user deniz 52.169.142.214 port 42498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-20 14:41:17 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:34196: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:44:09 host2 sshd[1291581]: Disconnected from invalid user runner 185.77.225.203 port 45624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 20 14:44:28 host2 sshd[1291704]: Disconnected from invalid user raaj 52.169.142.214 port 50712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:46:24 host2 sshd[1293475]: Disconnected from invalid user raaj 185.77.225.203 port 45238 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 14:47:20 host2 sshd[1293984]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:48:38 host2 sshd[1294806]: Disconnected from invalid user script 185.77.225.203 port 44864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.77.225.203
country_id: 6252001
description:
Nov 20 14:49:43 host2 sshd[1295327]: Disconnected from invalid user flectra 185.77.225.203 port 44670 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-20 14:52:20 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:37307: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.18
country_id: 6252001
description:
2025-11-20 14:52:49 dovecot_login authenticator failed for ([98.181.63.18]) [98.181.63.18]:47387: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 20 14:54:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<gku3QgNEl/4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-20 14:58:49 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (sapheabi) [73.197.236.163]:34950: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 14:59:27 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<FiNRVQNE0qkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:01:08 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<3edXWwNEzuIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:03:18 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<noYSYwNEOLIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 20 15:03:19 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<jkwrYwNEQrIDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.48
country_id: 3469034
description:
Nov 20 15:05:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.71.89.48, lip=66.85.158.91, TLS, session=<C0YBaQNE7eCxR1kw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.248
country_id: 3469034
description:
Nov 20 15:05:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.53.165.248, lip=66.85.158.91, TLS, session=<8PVNagNEFJqxNaX4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.56
country_id: 798544
description:
Nov 20 15:08:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=91.231.122.56, lip=66.85.158.91, TLS, session=<jgS5dANEeuNb53o4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.85
country_id: 3175395
description:
Nov 20 15:08:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=171.22.234.85, lip=66.85.158.91, TLS, session=<IgbOdQNEAeWrFupV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.66.41.67
country_id: 3469034
description:
Nov 20 15:17:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=177.66.41.67, lip=66.85.158.91, TLS, session=<GpBXlANEZaqxQilD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.82
country_id: 3865483
description:
Nov 20 15:17:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.238.107.82, lip=66.85.158.91, TLS, session=<2a6RlQNE1YMt7mtS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-20 15:26:33 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:33394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-20 15:27:00 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:49040: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 15:34:01 host2 sshd[1325478]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 15:44:38 host2 sshd[1332007]: Disconnected from invalid user tacuser 45.78.226.12 port 51186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:45:10 host2 sshd[1332653]: Disconnected from invalid user tejas 89.235.118.35 port 36824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 15:47:01 host2 sshd[1334182]: Disconnected from invalid user donavan 62.60.131.157 port 27251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:48:48 host2 sshd[1335243]: Disconnected from invalid user es 89.235.118.35 port 48276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:49:16 host2 sshd[1335547]: Disconnected from invalid user noreply 51.77.245.237 port 57086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 15:49:31 host2 sshd[1335635]: Disconnected from invalid user ftpuser 200.89.178.151 port 28457 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:50:14 host2 sshd[1336377]: Disconnected from invalid user newusername 89.235.118.35 port 48106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-20 15:51:50 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:36402: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-20 15:51:32 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:32858: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:52:35 host2 sshd[1338240]: Disconnected from invalid user admin 51.77.245.237 port 55866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 15:52:58 host2 sshd[1338628]: Disconnected from invalid user tidb 200.89.178.151 port 35588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:53:38 host2 sshd[1339327]: Disconnected from invalid user family 51.77.245.237 port 55458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.235.118.35
country_id: 130758
description:
Nov 20 15:54:21 host2 sshd[1340024]: Disconnected from invalid user elasticuser 89.235.118.35 port 60868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.245.237
country_id: 3017382
description:
Nov 20 15:54:36 host2 sshd[1340442]: Disconnected from invalid user frank 51.77.245.237 port 55050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:01:15 host2 sshd[1346546]: Disconnected from invalid user frank 45.78.226.12 port 50500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.158
country_id: 3469034
description:
Nov 20 16:01:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.247.158, lip=66.85.158.91, TLS, session=<HMP1MQREncG60fee>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.91
country_id: 3175395
description:
Nov 20 16:01:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=217.26.179.91, lip=66.85.158.91, TLS, session=<iD7UMAREds7ZGrNb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:03:44 host2 sshd[1349149]: Disconnected from invalid user art 45.78.226.12 port 54256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.178.151
country_id: 3865483
description:
Nov 20 16:03:09 host2 sshd[1348265]: Disconnected from invalid user ftpu 200.89.178.151 port 56985 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:03:25 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<y34aOgREysQDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.54
country_id: 241170
description:
Nov 20 16:04:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.232.94.54, lip=66.85.158.92, TLS handshaking: Connection closed, session=<U5IzPgREDi6c6F42>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:05:12 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<+UF3QAREWJwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:06:56 host2 sshd[1351787]: Disconnected from invalid user shared 122.155.223.2 port 51257 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:07:04 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Py8rRwREQoIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 20 16:07:24 host2 sshd[1352109]: Disconnected from invalid user client 45.78.223.11 port 54334 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:07:49 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<0I/WSQREzsgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 20 16:09:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<xgSWTgREeBNChJl3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:09:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<NT4zTwRE4IsDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:10:19 host2 sshd[1354562]: Disconnected from invalid user test 103.52.115.223 port 45094 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:10:38 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<EEXoUwRE4J4DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:11:29 host2 sshd[1355395]: Disconnected from invalid user null 45.78.226.12 port 40850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:11:57 host2 sshd[1355748]: Disconnected from invalid user jorge 103.52.115.223 port 53440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:11:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<NmSfVQREJKgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:12:08 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<g55KWQREQqcDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:12:25 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<6fxDWgREBsUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 16:13:47 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<8GMoXwRExNoDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:15:01 host2 sshd[1358144]: Disconnected from invalid user ubuntu22 103.52.115.223 port 50266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:15:13 host2 sshd[1358470]: Disconnected from invalid user ankur 198.12.77.137 port 58782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Nov 20 16:16:26 host2 sshd[1359329]: Disconnected from invalid user noreply 45.78.226.12 port 41220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:16:46 host2 sshd[1359614]: Disconnected from invalid user jira 62.97.44.51 port 56702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:17:22 host2 sshd[1360095]: Disconnected from invalid user jorge 198.12.77.137 port 42660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:17:07 host2 sshd[1359915]: Disconnected from invalid user admin 128.1.44.115 port 57880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:19:14 host2 sshd[1361350]: Disconnected from invalid user ankur 160.251.251.171 port 47580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:19:38 host2 sshd[1361705]: Disconnected from invalid user long 103.52.115.223 port 36186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.19
country_id: 3175395
description:
Nov 20 16:19:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.63.133.19, lip=66.85.158.91, TLS, session=<UWezcwREZN65P4UT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:20:49 host2 sshd[1362758]: Disconnected from invalid user arif 62.97.44.51 port 40414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.24
country_id: 798544
description:
Nov 20 16:20:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.125.4.24, lip=66.85.158.91, TLS, session=<VqbEdARE/6e5fQQY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:21:08 host2 sshd[1362973]: Disconnected from invalid user node1 160.251.251.171 port 33450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:21:32 host2 sshd[1363263]: Disconnected from invalid user epadmin 198.12.77.137 port 43332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:21:53 host2 sshd[1363484]: Disconnected from invalid user casa 62.97.44.51 port 34152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:22:58 host2 sshd[1364187]: Disconnected from invalid user ansadmin 62.97.44.51 port 49976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 20 16:23:23 host2 sshd[1364529]: Disconnected from invalid user admin 45.78.223.11 port 34580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:24:53 host2 sshd[1365688]: Disconnected from invalid user xyh 160.251.251.171 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:24:28 host2 sshd[1365452]: Disconnected from invalid user csgoserver 110.78.149.76 port 46750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:24:37 host2 sshd[1365527]: Disconnected from invalid user rizzo 103.166.187.238 port 55398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:25:13 host2 sshd[1366036]: Disconnected from invalid user chrome 62.97.44.51 port 52748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:25:19 host2 sshd[1366141]: Disconnected from invalid user xyh 122.155.223.2 port 44781 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:25:58 host2 sshd[1366656]: Disconnected from invalid user jira 103.166.187.238 port 54796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:26:07 host2 sshd[1366786]: Disconnected from invalid user egarcia 128.1.44.115 port 35904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:27:18 host2 sshd[1367535]: Disconnected from invalid user git 103.166.187.238 port 49464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:27:23 host2 sshd[1367594]: Disconnected from invalid user hyper 122.155.223.2 port 26005 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:27:25 host2 sshd[1367613]: Disconnected from invalid user steam 128.1.44.115 port 46108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:28:39 host2 sshd[1368496]: Disconnected from invalid user reza 160.251.251.171 port 42610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:28:45 host2 sshd[1368554]: Disconnected from invalid user dev 128.1.44.115 port 47812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:28:13 host2 sshd[1368214]: Disconnected from invalid user admin 31.193.128.244 port 51184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:29:15 host2 sshd[1368895]: Disconnected from invalid user ubuntu 110.78.149.76 port 33604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:30:52 host2 sshd[1370398]: Disconnected from invalid user steam 110.78.149.76 port 48876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:32:11 host2 sshd[1371293]: Disconnected from invalid user ganesh 189.30.117.80 port 36696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:32:49 host2 sshd[1371686]: Disconnected from invalid user paco 31.193.128.244 port 34238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:33:35 host2 sshd[1372099]: Disconnected from invalid user steam 189.30.117.80 port 47666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov 20 16:33:09 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, session=<hflrpAREvMunXpI6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:35:06 host2 sshd[1373369]: Disconnected from invalid user admin 31.193.128.244 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:34:18 host2 sshd[1372616]: Disconnected from invalid user laravel 189.30.117.80 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:35:06 host2 sshd[1373362]: Disconnected from invalid user kdh 179.216.23.19 port 45459 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:35:46 host2 sshd[1373938]: Disconnected from invalid user carla 110.78.149.76 port 59102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:38:35 host2 sshd[1376078]: Disconnected from invalid user dev 31.193.128.244 port 35606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:39:29 host2 sshd[1376742]: Disconnected from invalid user guest 179.216.23.19 port 1885 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:41:29 host2 sshd[1378671]: Disconnected from invalid user donavan 62.60.131.157 port 24855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:41:33 host2 sshd[1378748]: Disconnected from invalid user actions 179.216.23.19 port 1903 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 16:44:18 host2 sshd[1380842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:44:21 host2 sshd[1380868]: Disconnected from invalid user r00t 188.247.31.91 port 49167 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 20 16:44:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<7q1ZzQREzoWUcdUX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:45:44 host2 sshd[1382640]: Disconnected from invalid user admin 188.247.31.91 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 16:48:59 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:46248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:48:21 host2 sshd[1384688]: Disconnected from invalid user dev 101.47.143.192 port 36560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 16:49:16 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (matande) [81.225.30.107]:51426: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-20 16:49:48 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:34995: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:50:49 host2 sshd[1386792]: Disconnected from invalid user yusuf 101.47.143.192 port 34062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:55:42 host2 sshd[1391162]: Disconnected from invalid user bitwarden 101.47.143.192 port 51160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:59:26 host2 sshd[1394075]: Disconnected from invalid user draven 62.60.131.157 port 15555 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.224
country_id: 953987
description:
Nov 20 17:02:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=102.129.54.224, lip=66.85.158.91, TLS, session=<7ch/DQVE181mgTbg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.241
country_id: 3469034
description:
Nov 20 17:02:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.96.241, lip=66.85.158.91, TLS, session=<q5BLDAVEbq6xLGDx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-20 17:04:01 dovecot_plain authenticator failed for (scumnodied) [64.72.74.162]:45616: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2025-11-20 17:08:24 dovecot_plain authenticator failed for (wynon) [195.133.156.119]:43867: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.147
country_id: 3469034
description:
Nov 20 17:18:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=138.36.202.147, lip=66.85.158.91, TLS, session=<QwfoRgVEYtuKJMqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Nov 20 17:19:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<85csSAVE+hDI7VWg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:25:23 host2 sshd[1416626]: Disconnected from invalid user rex 194.105.81.37 port 46194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:29:42 host2 sshd[1420418]: Disconnected from invalid user dns 45.205.30.37 port 41576 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 17:31:09 host2 sshd[1421701]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:33:07 host2 sshd[1423543]: Disconnected from invalid user bitcoin 45.205.30.37 port 38216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-20 17:33:46 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:59348: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-20 17:34:34 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:39590: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:34:34 host2 sshd[1424851]: Disconnected from invalid user victor 194.105.81.37 port 48398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.157.32
country_id: 337996
description:
2025-11-20 17:34:59 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:35:27 host2 sshd[1425822]: Disconnected from invalid user info 45.205.30.37 port 41420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-20 17:35:18 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:40790: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:36:47 host2 sshd[1426831]: Disconnected from invalid user chrome 194.105.81.37 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:37:43 host2 sshd[1427831]: Disconnected from invalid user yousef 45.205.30.37 port 49206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:38:54 host2 sshd[1428877]: Disconnected from invalid user sbot 45.205.30.37 port 33356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-20 17:45:56 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (tedlembed) [73.68.220.15]:38668: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-20 17:48:19 dovecot_plain authenticator failed for (gited) [12.150.243.22]:3812: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Nov 20 17:58:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<gXic1QVEv9cfs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.120
country_id: 798544
description:
Nov 20 17:59:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.101.120, lip=66.85.158.91, TLS, session=<M2Sx1gVEeNyy22V4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-20 18:03:14 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (hellinecty) [71.224.169.28]:57942: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-20 18:06:04 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:37864: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 18:11:26 host2 sshd[1461484]: Disconnected from invalid user jameson 62.60.131.157 port 21214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.222
country_id: 3996063
description:
2025-11-20 18:15:03 dovecot_login authenticator failed for ([201.172.88.222]) [201.172.88.222]:48918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Nov 20 18:15:36 host2 pure-ftpd[1464749]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.175
country_id: 798544
description:
Nov 20 18:18:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=109.125.247.175, lip=66.85.158.91, TLS, session=<X21cHQZEIbBtffev>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.200
country_id: 3077311
description:
Nov 20 18:19:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.163.38.200, lip=66.85.158.91, TLS, session=<1I2eHgZEupRVoybI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 18:24:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59471: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.89.179.43
country_id: 6252001
description:
Nov 20 18:25:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=35.89.179.43, lip=66.85.158.91, TLS: Connection closed, session=<FcDUNwZE8NcjWbMr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.176.214.185
country_id: 6252001
description:
Nov 20 18:35:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.176.214.185, lip=66.85.158.91, TLS: Connection closed, session=<RQmiWgZEwsE2sNa5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.7
country_id: 3865483
description:
Nov 20 18:40:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.89.7, lip=66.85.158.91, TLS, session=<C+hoawZER8W+tVkH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 20 18:40:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<7uSdbAZE/bOynG0e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 18:42:15 host2 sshd[1485268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.120
country_id: 3469034
description:
Nov 20 18:42:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.250.120, lip=66.85.158.91, TLS, session=<ThwycQZE9MG60fp4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.90.2.146
country_id: 798544
description:
Nov 20 18:42:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=45.90.2.146, lip=66.85.158.91, TLS, session=<xZNjcgZE/8MtWgKS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:45:10 host2 sshd[1488037]: Disconnected from invalid user admin 107.172.146.104 port 60182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:46:08 host2 sshd[1488688]: Disconnected from invalid user guest 51.222.106.104 port 42612 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<sLPWgwZECuzPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<0PbagwZE3r3PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:48:28 host2 sshd[1490400]: Disconnected from invalid user user 51.222.106.104 port 60080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:49:21 host2 sshd[1491061]: Disconnected from invalid user elena 107.172.146.104 port 43944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:49:42 host2 sshd[1491500]: Disconnected from invalid user andre 51.222.106.104 port 36972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-20 18:50:53 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (mentiantly) [81.226.88.121]:35104: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.254.74.120
country_id: 6252001
description:
Nov 20 18:51:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=44.254.74.120, lip=66.85.158.92, TLS: Connection closed, session=<VCzNkgZESqks/kp4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:51:38 host2 sshd[1493231]: Disconnected from invalid user andre 107.172.146.104 port 37572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:57:19 host2 sshd[1498548]: Disconnected from invalid user front 51.222.106.104 port 44982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.222.104.59
country_id: 6252001
description:
Nov 20 18:58:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=34.222.104.59, lip=66.85.158.92, TLS: Connection closed, session=<RYveqgZEJroi3mg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-20 18:58:12 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (ancers) [68.60.77.128]:53340: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-20 18:59:04 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-20 18:59:15 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:02:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dr5WugZEyo0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:03:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<d7qJvgZElOIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:05:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<3k5LxQZEsMgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:07:24 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<DtkPzAZETqADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.190
country_id: 3469034
description:
Nov 20 19:10:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.246.190, lip=66.85.158.91, TLS, session=<jgiC1AZEVZ+60fa+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.246
country_id: 6290252
description:
Nov 20 19:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=109.207.34.246, lip=66.85.158.91, TLS, session=<z0ti0wZErrNtzyL2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:10:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<y4ne1QZEeNYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:11:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<333H2wZElOUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.92, session=<YcWR4AZEPT/OvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.67.48
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.67.48, lip=66.85.158.92, session=<OYWY4AZEkGaGekMw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 20 19:16:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS, session=<IJHr7AZEMvKl6Er8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:20:07 host2 sshd[1517644]: Disconnected from invalid user public 45.78.220.116 port 37134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov 20 19:21:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.91, TLS: Connection closed, session=<Pp4w/QZEtMyUccFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.128.246.187
country_id: 6252001
description:
Nov 20 19:21:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=138.128.246.187, lip=66.85.158.91, TLS: Connection closed, session=<MA0LAAdEvzKKgPa7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-20 19:25:17 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:40736: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-20 19:25:27 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:46673: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:25:49 host2 sshd[1522211]: Disconnected from invalid user user1 198.1.117.220 port 43674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:29:01 host2 sshd[1523883]: Disconnected from invalid user user 198.1.117.220 port 50264 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 19:29:37 host2 sshd[1524339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-20 19:31:05 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:59536: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-20 19:31:24 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:48786: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:33:47 host2 sshd[1527605]: Disconnected from invalid user app 198.1.117.220 port 49818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:35:06 host2 sshd[1528653]: Disconnected from invalid user user3 45.78.220.116 port 40594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.101.69
country_id: 3057568
description:
Nov 20 19:37:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=31.134.101.69, lip=66.85.158.91, TLS, session=<HjmpNgdEw+MfhmVF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.0.105.88
country_id: 2510769
description:
Nov 20 19:37:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.0.105.88, lip=66.85.158.91, TLS, session=<GD67NwdEl8ElAGlY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.106
country_id: 3996063
description:
Nov 20 19:39:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=38.65.137.106, lip=66.85.158.91, TLS, session=<F5+APAdEq8kmQYlq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Nov 20 19:39:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<Ln+iPQdEkKEr5eEz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.166.146
country_id: 6251999
description:
Nov 20 19:53:54 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=137.184.166.146, lip=66.85.158.91, TLS, session=<CXNkcgdExuiJuKaS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 19:57:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OlROfwdEQuii2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 19:57:36 host2 sshd[1547596]: Disconnected from invalid user ftp1 152.32.129.140 port 24572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:00:30 host2 sshd[1550180]: Disconnected from invalid user odoo 85.133.237.167 port 37222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:01:26 host2 sshd[1550836]: Disconnected from invalid user dan 152.32.129.140 port 24936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 20:01:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS, session=<8ETKjgdEruGi2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:02:53 host2 sshd[1552023]: Disconnected from invalid user mc2 85.133.237.167 port 33086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:02:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Q81XkgdESJkI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 20:03:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<AdbIlQdEssRSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 20:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<SlM9mgdERUMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:05:34 host2 sshd[1554637]: Disconnected from invalid user ubuntu 152.32.129.140 port 54236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:05:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<xsBdnQdEKrdn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:05:10 host2 sshd[1554371]: Disconnected from invalid user karim 51.178.141.222 port 35424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:05:19 host2 sshd[1554505]: Disconnected from invalid user es 79.112.19.63 port 51286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-20 20:06:47 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:42464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:06:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<J//voAdEZIIjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:06:16 host2 sshd[1555161]: Disconnected from invalid user xxx 51.178.141.222 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:06:26 host2 sshd[1555268]: Disconnected from invalid user bad 85.133.237.167 port 40460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:07:35 host2 sshd[1556051]: Disconnected from invalid user incoming 85.133.237.167 port 47974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-20 20:07:38 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:34506: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:08:43 host2 sshd[1556777]: Disconnected from invalid user emo 85.133.237.167 port 36616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:09:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<6URrqAdEvueLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:09:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<tU49qwdEfHxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 20:10:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=</z08rQdEhpCYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:10:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<KtMdrgdEdlgI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:11:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<YrwOsAdE9tOLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:11:29 host2 sshd[1558693]: Disconnected from invalid user red 79.112.19.63 port 34718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:11:46 host2 sshd[1558844]: Disconnected from invalid user red 51.178.141.222 port 60932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 20 20:11:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=8.216.40.228, lip=66.85.158.91, session=<cB6ysgdE5tQI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.25.110.103
country_id: 2635167
description:
Nov 20 20:11:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=82.25.110.103, lip=66.85.158.91, session=<0FvIsgdE4L1SGW5n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.140
country_id: 798544
description:
Nov 20 20:12:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.246.209.140, lip=66.85.158.91, TLS, session=<xBywswdEgdNb9tGM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:12:36 host2 sshd[1559353]: Disconnected from invalid user test 110.93.250.15 port 46658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.16
country_id: 3469034
description:
Nov 20 20:12:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.37.16, lip=66.85.158.91, TLS, session=<8JLHtAdEsI2/8CUQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:13:33 host2 sshd[1560062]: Disconnected from invalid user steam 152.32.129.140 port 57832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:13:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<AVfNuAdELL0I3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:14:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Q9A5vQdEBNai2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 20:15:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<oWH4vwdEWIaUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:15:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<K0m9wAdEfPui2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:15:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<fLj1vgdEpqQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:15:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<ljNFvwdE/Lln76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 20:16:47 host2 sshd[1562027]: Disconnected from invalid user alycia 62.60.131.157 port 8471 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:17:15 host2 sshd[1562341]: Disconnected from invalid user user 110.93.250.15 port 13173 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 20:17:19 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pergulae) [81.225.30.107]:39823: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:18:22 host2 sshd[1562978]: Disconnected from invalid user devuser 79.112.19.63 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:18:49 host2 sshd[1563183]: Disconnected from invalid user dan 110.93.250.15 port 23328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 20:19:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<0P0RzAdEGJkv+1FF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 20:19:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oS+jzAdEiN6l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:19:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS, session=<mkjNzQdEou+i2JZk>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 20:22:51 host2 sshd[1566224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:22:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<Nqjd2AdEtONrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:22:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<a5Cy2QdEarQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 20:23:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Y4OR2wdEQJAv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 20 20:23:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<dC073QdECMOH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-11-20 20:24:48 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:17414: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 20:24:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+VUA4QdEUoSPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-20 20:24:22 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:33022: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 20:26:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wf0/5QdE+LUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 20:26:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<zOpF5wdEINpn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-20 20:27:46 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (andapsyper) [98.192.114.251]:50798: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:27:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Mfok7AdERIII2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 20 20:30:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<9QjC9AdEGrpe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 20:30:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<85Xh9AdEMs5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 20:30:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<0mJw9gdEgKwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:33:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<dYUl/wdE0Mho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 20:35:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<b/HGBghEsJuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 20:35:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<A/SRBwhE4O3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:37:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<ZkmJDAhEIMBrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-20 20:38:05 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:38748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:39:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wGjPEwhEYqcjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-20 20:38:43 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:56401: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.114
country_id: 298795
description:
Nov 20 20:42:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=95.0.32.114, lip=66.85.158.91, TLS, session=<qadvHQhEjpBfACBy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:41:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9midGwhEoswI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Nov 20 20:42:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<cfATHwhEMqLEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.119
country_id: 2300660
description:
Nov 20 20:43:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=41.139.0.119, lip=66.85.158.91, TLS, session=<p7uSIwhEquQpiwB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.123
country_id: 798544
description:
Nov 20 20:44:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=195.205.4.123, lip=66.85.158.91, TLS, session=<mTq3JAhE5t3DzQR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:43:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wRhMIwhEetIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 20:43:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<miDGIwhEroVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 20:44:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<H5rPJghE9IaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 20:51:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<EYpZQQhE5oBnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 20:51:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<zrtaQAhEktpAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 20:55:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<9ezbTwhEBOql0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 20:58:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<V5d2WQhE/MSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 21:01:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<2h7HZAhE6JOUcQ1r>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 20 21:01:46 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS, session=<5dQSZQhEpd5X7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.157
country_id: 6252001
description:
Nov 20 21:02:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.157, lip=66.85.158.91, session=<pjIpZwhE/0ZAPpyd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 20 21:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS: Connection closed, session=<ZT3uZwhE5m5APpyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 21:03:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1ezuaQhE3txnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 21:04:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<BW2TbghEZsmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 21:05:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<UWDlcwhEuNgrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 21:07:02 host2 sshd[1601098]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 21:06:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<bniVdghEaMln76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 21:06:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5xQfdwhEqt6LO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.123.36
country_id: 6252001
description:
Nov 20 21:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=142.93.123.36, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2EwhfghELMaOXXsk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:08:51 host2 sshd[1602253]: Disconnected from invalid user zahid 189.112.0.11 port 50548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 21:10:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<W/f5gghELNwI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 20 21:11:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<RwRKhwhE3KsXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 21:13:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ezUokAhEvsVnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:16:04 host2 sshd[1609049]: Disconnected from invalid user supervisor 189.112.0.11 port 54336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 21:16:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<la8mmAhEAJBSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:15:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2ONTlQhEGJkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 21:16:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<987amghE/tOYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 21:17:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<dSRAnAhEQsxn76Vy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Nov 20 21:17:41 host2 pure-ftpd[1610241]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 21:18:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<EH9bnwhEAuZrhr+5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:18:53 host2 sshd[1611020]: Disconnected from invalid user it 189.112.0.11 port 57200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 21:21:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Mv6dqwhEsJto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 20 21:24:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=8.216.40.228, lip=66.85.158.91, session=<z5VEtQhENM8I2Cjk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Nov 20 21:24:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<bZMKtwhEdh+nXpI0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.175.194.50
country_id: 6252001
description:
2025-11-20 21:25:34 dovecot_plain authenticator failed for (158-94-208-178.virtualine.org) [136.175.194.50]:22241: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 21:28:02 host2 sshd[1618540]: Disconnected from invalid user clifton 62.60.131.157 port 62868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-20 21:28:14 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:54233: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-20 21:28:34 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:37378: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 21:29:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<AiuOyAhELJ8v+1FF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 20 21:30:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<v8HxyghEkl2nXpI7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 147.185.242.186
country_id: 6252001
description:
Nov 20 21:30:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=147.185.242.186, lip=66.85.158.91, TLS: Connection closed, session=<3R3YywhE1wyTufK6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 21:30:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Ui4KzAhEhLWUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 20 21:32:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, session=<V2uY0whEFqhKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 21:33:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rSqJ1QhE8qil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 21:33:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<buzZ1QhEpqkv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 21:33:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<v8zX1ghENLhrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 21:36:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1H/Z4ghEaLuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.25.110.103
country_id: 2635167
description:
Nov 20 21:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=82.25.110.103, lip=66.85.158.91, session=<MkGR5QhEtNNSGW5n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 21:39:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<rLPr6ghEmusI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 21:39:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=</uIu7QhE0K8v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.194
country_id: 3469034
description:
Nov 20 21:39:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.130.170.194, lip=66.85.158.91, TLS, session=<Jp1y7AhE2LixgqrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.117.77
country_id: 3469034
description:
Nov 20 21:40:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.22.117.77, lip=66.85.158.91, TLS, session=<xsqn7QhE39OxFnVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 21:40:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<zdWh8AhElLwEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.89.235.196
country_id: 6252001
description:
Nov 20 21:41:15 host2 sshd[1629507]: Disconnected from invalid user adminer 47.89.235.196 port 53462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 21:41:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<bBA88ghE7KZn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.199
country_id: 3469034
description:
Nov 20 21:41:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=45.7.187.199, lip=66.85.158.91, TLS, session=<1xNL8ghEerAtB7vH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.106.14
country_id: 798544
description:
Nov 20 21:41:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=178.219.106.14, lip=66.85.158.91, TLS, session=<hZaA8whEe92y22oO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.89.235.196
country_id: 6252001
description:
Nov 20 21:42:32 host2 sshd[1630846]: Disconnected from invalid user minecraft 47.89.235.196 port 55044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:43:40 host2 sshd[1633126]: Disconnected from invalid user es 177.53.215.134 port 59214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:43:47 host2 sshd[1634160]: Disconnected from invalid user hl 118.26.39.178 port 44564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 21:45:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Rx5MAAlEVMdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 21:45:40 host2 sshd[1645490]: Disconnected from invalid user dejah 62.60.131.157 port 34494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:46:54 host2 sshd[1646285]: Disconnected from invalid user mostafa 118.26.39.178 port 46846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:48:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IJHTCwlENH0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-11-20 21:48:55 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:50270: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 21:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<R5ikDQlEOtXIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-20 21:49:15 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:44820: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.84
country_id: 6252001
description:
Nov 20 21:49:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.84, lip=66.85.158.92, session=<QxJOEAlEwSpBMQFU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:49:48 host2 sshd[1648672]: Disconnected from invalid user fivem 118.26.39.178 port 58624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 20 21:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, TLS: Connection closed, session=<VN8bEQlEnC9BMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-11-20 21:50:43 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:34657: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-20 21:50:51 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:59037: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Nov 20 21:51:41 host2 pure-ftpd[1650165]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 21:52:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=</gGdGAlEvJBm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 21:53:00 host2 sshd[1651042]: Disconnected from invalid user ilaria 101.47.142.10 port 56488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:52:49 host2 sshd[1650967]: Disconnected from invalid user ads1 118.26.39.178 port 44610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:52:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Qn+6GwlERKojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 20 21:56:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<gGhCJwlEPt5e0RIJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:56:49 host2 sshd[1654285]: Disconnected from invalid user kdm 177.53.215.134 port 55918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:58:07 host2 sshd[1655050]: Disconnected from invalid user ads1 177.53.215.134 port 58418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 21:57:50 host2 sshd[1654877]: Disconnected from invalid user justin 101.47.142.10 port 50932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 22:00:33 host2 sshd[1656489]: Disconnected from invalid user jamshid 101.47.142.10 port 33842 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.75.124
country_id: 597427
description:
Nov 20 22:02:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=69.62.75.124, lip=66.85.158.91, session=<QlJ/PQlEBJ9FPkt8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 22:02:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<A8tZPwlEdJRAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 22:02:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<czFIPwlExo6LO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 22:03:13 host2 sshd[1658069]: Disconnected from invalid user test3 101.47.142.10 port 58590 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:03:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<k4/oQAlEmqNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 22:03:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<TXlAQglEYruSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 22:05:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<a+IJSAlE/J+LO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:05:28 host2 sshd[1660519]: Disconnected from invalid user dev 193.106.245.20 port 34738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:07:43 host2 sshd[1661708]: Disconnected from invalid user angela 83.118.24.18 port 56432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:08:07 host2 sshd[1661982]: Disconnected from invalid user kali 193.106.245.20 port 35645 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:08:59 host2 sshd[1662371]: Disconnected from invalid user stack 34.142.110.144 port 44358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 22:08:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+E2uUwlEzowI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 22:08:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<Bi+VUwlEXrlnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.35.162
country_id: 3469034
description:
Nov 20 22:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.37.35.162, lip=66.85.158.91, TLS, session=<hQ+oVQlEPdy/JSOi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.202
country_id: 1269750
description:
Nov 20 22:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.30.81.202, lip=66.85.158.91, TLS, session=<T+juVglEvJpnHlHK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:10:05 host2 sshd[1663025]: Disconnected from invalid user marc 34.142.110.144 port 43402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 22:10:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<UnGjWQlEJtukXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:10:42 host2 sshd[1663511]: Disconnected from invalid user temp 193.106.245.20 port 42865 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:11:37 host2 sshd[1663970]: Disconnected from invalid user ubuntu 83.118.24.18 port 51514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 22:12:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<oUQBYQlErNtn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.20
country_id: 1880251
description:
Nov 20 22:12:26 host2 sshd[1664782]: Disconnected from invalid user gitlab-runner 101.47.162.20 port 42506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:13:26 host2 sshd[1665649]: Disconnected from invalid user angela 193.106.245.20 port 43752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:14:36 host2 sshd[1666156]: Disconnected from invalid user storage 34.142.110.144 port 39592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.20
country_id: 1880251
description:
Nov 20 22:15:01 host2 sshd[1666390]: Disconnected from invalid user robert 101.47.162.20 port 56762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 22:15:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<LfrPawlEhJJrhr+5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:15:35 host2 sshd[1667195]: Disconnected from invalid user liming 83.118.24.18 port 37896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 22:18:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<73LCdQlErI+UcQ1r>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 22:19:05 host2 sshd[1669897]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 22:21:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<r2YPgwlEbuOl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 22:22:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<nd7AhglEiN5n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 22:23:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<MuteiAlExGovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:23:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ntNWiQlEsLlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 22:25:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sj09kAlEqqsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 22:25:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<6KP6kAlEnO0rpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 20 22:28:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZMFfmwlE73xAPpx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 22:28:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<YUpsnAlEiLmYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 22:30:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<Dlq6owlEpp9rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-20 22:32:56 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:57666: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 22:32:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<CeIHqwlELrZSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-20 22:33:16 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:4391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov 20 22:34:10 host2 pure-ftpd[1681928]: (?@64.62.197.212) [INFO] New connection from 64.62.197.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 22:34:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<NcbIrwlECmVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:34:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<EaP7rwlEQuNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.66.136
country_id: 6252001
description:
Nov 20 22:36:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.66.136, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ES6fuAlE+qKkXEKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.154
country_id: 953987
description:
Nov 20 22:37:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.129.57.154, lip=66.85.158.91, TLS, session=<UsH3uAlEnKFmgTma>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.167.34
country_id: 3865483
description:
Nov 20 22:37:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.181.167.34, lip=66.85.158.91, TLS, session=<0chuuglEIpkttaci>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 22:37:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<er1hvAlEXJwI3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 22:38:28 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57252: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.229.31.216
country_id: 690791
description:
Nov 20 22:38:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.229.31.216, lip=66.85.158.91, TLS, session=<oxKYvglErt9t5R/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.75
country_id: 2300660
description:
Nov 20 22:39:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<art>, method=PLAIN, rip=41.139.10.75, lip=66.85.158.91, TLS, session=<3j7VvwlE85MpiwpL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 22:41:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<fdlgyQlE2KYv+1FF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-20 22:43:03 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50666: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-20 22:42:36 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:33570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-20 22:43:36 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:59832: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 22:44:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Ruxp0wlEsMUv/DJe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.167
country_id: 6252001
description:
Nov 20 22:46:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</MoA3QlEmN8UQcKn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 22:47:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<N70g3wlE/t6UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 22:48:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fZwP4wlEuoSl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.248.118
country_id: 6252001
description:
Nov 20 22:48:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.248.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<l9wX5AlEXOgoTPh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 22:50:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<I8IZ6AlEFJSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 20 22:49:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<H7Se5glESqMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 22:50:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<jMaT6QlEuokv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 20 22:54:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Itgf+AlEDA7Y2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 20 22:54:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=135.235.33.79, lip=66.85.158.91, session=<JfbC+AlEat6H6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov 20 22:55:25 host2 pure-ftpd[1699357]: (?@205.210.31.92) [INFO] New connection from 205.210.31.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 22:56:10 host2 sshd[1700113]: Disconnected from invalid user emmalee 62.60.131.157 port 6307 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 22:56:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Izhr/wlEMKYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 22:58:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kCuoBQpEoLVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 22:58:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<xO7eBwpEZEkjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.87
country_id: 6252001
description:
Nov 20 23:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.87, lip=66.85.158.92, TLS: Connection closed, session=<oVKQDwpEUCfHLZtX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 23:01:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<JYGIEApEBqaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 23:03:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5anLFwpE7qMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 23:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<9v4tGQpEdtKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 23:03:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<aOpQGQpE3tJn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 23:04:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<KBlmHQpEvubIMGRT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 23:06:19 host2 sshd[1708517]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.23
country_id: 3175395
description:
Nov 20 23:06:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.170.23, lip=66.85.158.91, TLS, session=<YFlDIgpEKdm5D6oX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.247
country_id: 3865483
description:
Nov 20 23:06:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.177.200.247, lip=66.85.158.91, TLS, session=<+N1hIwpEDNQtscj3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 23:07:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<YrGtJQpEzKsI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 23:12:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<L4rpNwpESLNrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 23:13:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Z2QJPApE3OZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 23:15:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=</26aQQpE5otAF/Qn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 20 23:16:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS: Connection closed, session=<gArJRwpEFNOUcdZj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.9
country_id: 6252001
description:
Nov 20 23:17:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.9, lip=66.85.158.91, session=<Y/0VSQpESNgUQcIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 23:17:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<tg2zSgpE1u1n76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-20 23:19:32 dovecot_login authenticator failed for ([165.169.82.194]) [165.169.82.194]:54783: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-20 23:19:54 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:57854: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 20 23:20:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<1WEAVQpEsO64aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 20 23:21:07 host2 pure-ftpd[1720953]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 23:22:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BCPFXQpE2K+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:24:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nVUpYwpEUNBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 23:25:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<9to6aApEEMRnmSo4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov 20 23:26:11 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.92, session=<oS2KaQpELoWsaAsi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 23:28:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<cW4JcApEeKlrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 23:28:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<lHAVcApEWIJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 23:32:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<q5LTgApEAr6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 23:34:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<iQnViApEdPsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 23:35:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Hn1higpE1MaUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 23:36:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JYCZjQpE1HAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 23:36:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<uhfujgpEQLsI3ocK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.68
country_id: 6252001
description:
Nov 20 23:39:23 host2 pure-ftpd[1734964]: (?@184.105.139.68) [INFO] New connection from 184.105.139.68


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 23:41:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<pz5OoQpERreSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 23:41:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<rLUvoQpEIuGYNbyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.0.89.94
country_id: 226074
description:
Nov 20 23:43:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=196.0.89.94, lip=66.85.158.91, session=<5PSDpwpE0+TEAFle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.65
country_id: 3175395
description:
Nov 20 23:43:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=217.26.179.65, lip=66.85.158.91, TLS, session=</cuWpwpEDNrZGrNB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:45:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<bC/frApECKFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 23:45:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<e1UfrwpEDpQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 20 23:46:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<isLkswpE5kFBMQHA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 23:47:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Q6sDtQpEDgRo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 23:47:27 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:53210: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 20 23:47:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2ZIPtQpE2D9BMQHA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 23:48:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<jJ47uQpE3rSl0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 23:48:44 host2 sshd[1741331]: Disconnected from invalid user emmalee 62.60.131.157 port 18584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 23:50:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<+JSDwQpEqshSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 23:53:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<xqloygpEvq0v+1FF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 20 23:53:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<e1OsygpEdr5ChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-20 23:55:57 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:47166: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:55:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gdTw0wpEptJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-20 23:55:38 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:63387: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 23:55:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<0I990wpEht8v/DJe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Nov 20 23:56:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VTQr1QpER9XG6xhN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-20 23:56:21 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:50369: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-20 23:56:40 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:41164: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:00:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Id6Y4gpEvM2LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 21 00:01:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<dm645wpESLQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:02:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<taBK6wpE3siLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Nov 21 00:03:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.157, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kbuh7wpEiZm594md>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 21 00:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<k+LH7wpEmKGPbtX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.156
country_id: 2635167
description:
Nov 21 00:03:40 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.156, lip=66.85.158.92, TLS, session=<Ri2V7wpEf7K594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Nov 21 00:04:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0Dud8QpEUcC594me>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 00:04:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<8fZw8QpE+sCl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 21 00:04:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<D4WZ8wpEseG594mf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 21 00:04:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Q/Ae9ApEANuUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.168
country_id: 2635167
description:
Nov 21 00:05:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.168, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<l/mU9QpEN55X7LCo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.162
country_id: 2635167
description:
Nov 21 00:05:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.162, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<hFuQ9wpEC4y594mi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 00:05:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<wp6c9wpEpMoI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.151
country_id: 2635167
description:
Nov 21 00:06:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.151, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a/KJ+QpEUYFX7LCX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.177
country_id: 2635167
description:
Nov 21 00:07:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oLqH+wpEwai594mx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.149
country_id: 2635167
description:
Nov 21 00:08:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.149, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<n199/wpEz71X7LCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.147
country_id: 2635167
description:
Nov 21 00:07:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.147, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Xa6D/QpEX+W594mT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.172
country_id: 2635167
description:
Nov 21 00:08:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<jBB5AQtEAaO594ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.80.149
country_id: 6252001
description:
Nov 21 00:09:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.80.149, lip=66.85.158.92, session=<T+bBAwtEls0ofFCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 00:09:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<KCQBBgtEFIFrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:10:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LkspBwtEeCsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 21 00:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</hl7CwtEEqFo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 21 00:13:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=135.235.33.79, lip=66.85.158.91, session=<dJ8dEgtEKp+H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:14:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UD5WFwtEpEQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.39.24
country_id: 2395170
description:
Nov 21 00:15:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=154.127.39.24, lip=66.85.158.91, TLS, session=<TdsUFwtEcbSafycY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.57
country_id: 953987
description:
Nov 21 00:15:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.52.57, lip=66.85.158.91, TLS, session=<L1pKGAtE74hmgTQ5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.107
country_id: 798544
description:
Nov 21 00:16:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=212.59.224.107, lip=66.85.158.91, TLS, session=<itjtHAtEkcXUO+Br>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.250
country_id: 6290252
description:
Nov 21 00:16:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=109.207.35.250, lip=66.85.158.91, TLS, session=<HEr/HQtEq8JtzyP6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 00:17:33 host2 sshd[1763208]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-11-21 00:20:16 dovecot_login authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:54438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-21 00:20:36 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:56764: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 21 00:21:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<BmNULgtEHKTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 00:22:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<7CAwNAtEnJFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 00:25:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<9ZRuPgtEKMhrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 21 00:27:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<05vyQwtEMq5AF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 00:27:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3hpURgtEItgXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.235
country_id: 6252001
description:
Nov 21 00:29:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.235, lip=66.85.158.91, TLS handshaking: Connection closed, session=<G5zuTAtEP5DDuEzr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.239
country_id: 6252001
description:
Nov 21 00:29:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.239, lip=66.85.158.91, TLS: Connection closed, session=<rumMTQtE/5HDuEzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.10
country_id: 6252001
description:
Nov 21 00:30:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.10, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xMI2TgtEFdnDuEwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Nov 21 00:30:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.91, TLS: Connection closed, session=<VitlTgtEv8zDuEzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.223
country_id: 3865483
description:
Nov 21 00:32:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.97.223, lip=66.85.158.91, TLS, session=<SGFMVAtEMqC+tWHf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.155.4
country_id: 3077311
description:
Nov 21 00:32:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=80.82.155.4, lip=66.85.158.91, TLS, session=<3eZsVQtEDdxQUpsE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 00:33:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<OmLYWQtEbJRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 00:34:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<oGTQXgtEkrxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 00:34:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<aMZWXwtEbshm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 00:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<FLi/YAtEFtoI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 00:36:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<m0C2YwtECq2kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:42:14 host2 sshd[1781822]: Disconnected from invalid user hussain 187.174.238.116 port 40232 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 00:44:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<NW3xgAtEGoNnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:46:05 host2 sshd[1784536]: Disconnected from invalid user testusr 187.174.238.116 port 37728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 21 00:46:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CbMCiQtEQsNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 00:47:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<sDAXjQtEbZIvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:48:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VPB7jgtEgpQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:48:25 host2 sshd[1785981]: Disconnected from invalid user mt 187.174.238.116 port 36054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:51:57 host2 sshd[1788019]: Disconnected from invalid user new 187.174.238.116 port 33542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.10.250
country_id: 2328926
description:
Nov 21 00:52:26 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.10.250, lip=66.85.158.92, session=<vKMHngtEttqlmgr6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 21 00:53:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<98/soAtEPu2UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 00:54:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<jXBfpQtEVqGYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 00:55:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<zl66qQtEnNVe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:59:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<eu1YtQtELKSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.149
country_id: 798544
description:
Nov 21 00:58:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.216.31.149, lip=66.85.158.91, TLS, session=<UgRZsQtE5Lyy2B+V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.134
country_id: 3469034
description:
Nov 21 00:58:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.209.251.134, lip=66.85.158.91, TLS, session=<gseKsgtETMO60fuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 21 01:01:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ldL1vQtEgHZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 01:01:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<35QOvgtEHtqLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.10.250
country_id: 2328926
description:
Nov 21 01:03:39 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.10.250, lip=66.85.158.91, session=<h5EbxgtExo6lmgr6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 01:04:35 host2 sshd[1796094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 01:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<eiYIywtEjukI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 21 01:05:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<OWLXywtEkLUv+1FF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 01:07:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7NYm0gtEpK4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 21 01:07:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<aj1+0wtEgt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 21 01:07:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<S1JF1AtE2Isv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 01:07:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<puyl1AtEoM5rhr+5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 21 01:09:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<uAK32QtEqLOnXpI8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 21 01:09:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<keDK2wtEip9SczCz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov 21 01:09:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<Ddzs2wtEvpRChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 21 01:11:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<9A3U4AtE1CxChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-21 01:14:09 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:57318: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 21 01:14:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<+Of66wtEgqov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.102
country_id: 1269750
description:
Nov 21 01:22:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=103.246.170.102, lip=66.85.158.91, TLS, session=<IGqyBgxEVeln9qpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.88.98
country_id: 3469034
description:
Nov 21 01:22:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.22.88.98, lip=66.85.158.91, TLS, session=<eEIOCAxE3KqxFlhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 01:30:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lPtvJAxEttSLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 21 01:33:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<vWdlMQxEjLdChJlx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 01:34:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<6KMxNQxE5mItTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 01:37:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<XqjoPQxEzOlm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 01:38:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<h2faQQxEIM8v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 01:38:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<S9VdQgxENJkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 01:40:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<tFMOSQxEPucrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 01:40:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<nF3VSgxEpoWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 01:45:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=</RpFXAxEAoUvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 01:46:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<J8XKYAxEfNln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 01:46:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<WtJiYAxEHpMv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 01:49:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<65MfaQxEJt1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 01:51:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BJmtcQxEfMekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 01:52:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<uUC5dAxE1KoI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Nov 21 01:52:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<b1jgdQxEm8yTuYR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 01:53:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kl5BdwxESJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 01:54:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<hjOBfQxEatIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-21 01:55:12 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:50836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 01:55:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<6fNgfgxELIGElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-11-21 01:55:23 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:59370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 01:56:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<EfoHgwxEBuJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 01:58:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<AsjjiAxEYqVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 01:59:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<a1jbjQxE7MAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:02:27 host2 sshd[1835619]: Disconnected from invalid user user 69.5.13.70 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:03:01 host2 sshd[1835935]: Disconnected from invalid user superset 152.32.185.214 port 34978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.182.245
country_id: 2921044
description:
Nov 21 02:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.182.245, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</DgXmwxE0oOkXLb1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 02:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<uxG0oQxEwtAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 02:05:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<Xi3LoQxEloFe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 02:05:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<o6YSogxELkSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:05:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<LIwkogxEYqItTeM5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:06:39 host2 sshd[1838939]: Disconnected from invalid user eric 152.32.185.214 port 56538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.196
country_id: 798544
description:
Nov 21 02:06:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=91.240.44.196, lip=66.85.158.91, TLS, session=<f2HNpAxEUdhb8CzE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.10.197.189
country_id: 3469034
description:
Nov 21 02:06:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.10.197.189, lip=66.85.158.91, TLS, session=<dEnmpQxEXsOxCsW9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:07:52 host2 sshd[1839689]: Disconnected from invalid user cps 69.5.13.70 port 54286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:07:51 host2 sshd[1839672]: Disconnected from invalid user karthik 152.32.185.214 port 49710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 02:08:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<24WQrgxEyNwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 02:08:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<ITnqrgxExrKl0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:09:03 host2 sshd[1840619]: Disconnected from invalid user victor 152.32.185.214 port 50944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:09:33 host2 sshd[1840976]: Disconnected from invalid user repository 51.83.46.40 port 38544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 02:10:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gBtcswxE9MGKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:10:31 host2 sshd[1841792]: Disconnected from invalid user ubuntu 92.207.4.157 port 54468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:10:33 host2 sshd[1841890]: Disconnected from invalid user user 69.5.13.70 port 45500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:10:36 host2 sshd[1841933]: Disconnected from invalid user admin 46.249.101.120 port 50026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:10:39 host2 sshd[1841999]: Disconnected from invalid user srv 51.83.46.40 port 51982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.22
country_id: 6252001
description:
Nov 21 02:10:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+akttQxEE83N0h8W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:11:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<M5Q7ugxEYLIrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:11:56 host2 sshd[1842745]: Disconnected from invalid user ricardo 69.5.13.70 port 39672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 02:13:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oPh0vgxEyrgXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:13:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XJo9wAxEgNErmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:13:58 host2 sshd[1844642]: Disconnected from invalid user tom 92.207.4.157 port 34094 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 02:14:29 host2 sshd[1845047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:15:57 host2 sshd[1846261]: Disconnected from invalid user george 51.83.46.40 port 52550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 02:16:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<1yvmyAxEqtmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:15:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<DzeuxgxEyKctTeM5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-21 02:18:34 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:55654: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:18:39 host2 sshd[1848172]: Disconnected from invalid user parking 92.207.4.157 port 44572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-21 02:18:51 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:54980: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:20:17 host2 sshd[1849400]: Disconnected from invalid user nfsuser 46.249.101.120 port 38304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:21:22 host2 sshd[1850136]: Disconnected from invalid user xmr 92.207.4.157 port 49812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:21:11 host2 sshd[1850030]: Disconnected from invalid user tom 51.83.46.40 port 60476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 02:25:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<qEAX6QxEyNtm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:24:10 host2 sshd[1852149]: Disconnected from invalid user username 46.249.101.120 port 59186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 02:24:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<M4k35gxEZpkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 02:24:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<uhLZ5gxEspov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 02:25:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mcic6QxEyKeYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Nov 21 02:25:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hMzH6wxE0tqTuYRG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 02:26:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<w1po7wxE+LYrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.6
country_id: 6252001
description:
Nov 21 02:27:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.6, lip=66.85.158.92, session=<etnB8QxEjrSH7X4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:28:05 host2 sshd[1854834]: Disconnected from invalid user hari 46.249.101.120 port 50128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 02:29:51 host2 sshd[1855858]: Disconnected from invalid user emmett 62.60.131.157 port 35923 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 02:31:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<qI/MAA1E9K0vWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.12
country_id: 2510769
description:
Nov 21 02:32:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 44 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.214.138.12, lip=66.85.158.91, TLS, session=<r7qPAA1E35u51ooM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 02:32:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<3dMqAw1EHp2SOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 21 02:32:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<SZWFAw1EPPfG6xhl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 02:32:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<H/2hBA1Ezrkv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.48
country_id: 3469034
description:
Nov 21 02:33:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=177.71.89.48, lip=66.85.158.91, TLS, session=<ePCLBA1Edc6xR1kw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 02:34:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<C4BXDA1Efpsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 02:34:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Q/fjCg1EAoykXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.211
country_id: 3017382
description:
Nov 21 02:35:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.211, lip=66.85.158.91, TLS: Connection closed, session=</pPADg1E1elb51nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Nov 21 02:35:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.209, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zi+ZDw1EVaNb51nR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.213
country_id: 3017382
description:
Nov 21 02:35:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.213, lip=66.85.158.91, TLS: Connection closed, session=<dSXJDw1Etdxb51nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.214
country_id: 3017382
description:
Nov 21 02:35:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<trEgDg1EhZVb51nW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 02:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<XNJJDg1EfJdnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 02:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wZ1LDg1E8JFn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:37:39 host2 sshd[1861306]: Disconnected from invalid user frappe 46.249.101.120 port 55672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 02:37:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1C1dFg1EQNoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 02:37:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<hjBUFw1EiIeElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 02:39:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65377: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 02:41:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3QHgIg1EtqQv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.213
country_id: 6252001
description:
Nov 21 02:41:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.185.213, lip=66.85.158.91, session=<UIhiJQ1ETIgofLnV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 02:41:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E87cIg1EUIYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 02:42:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<1NRXKA1E8NBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 02:44:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<51FnLg1EOJBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:46:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<IBvfNA1EHK0tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 02:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<DxiHPg1E7OQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 02:50:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ZAZ9RA1EJOmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 02:53:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<MRMXTg1EeJGKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Nov 21 02:53:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<vTxnTQ1EZ6yy2B4b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.239.77.14
country_id: 3996063
description:
Nov 21 02:53:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.239.77.14, lip=66.85.158.91, TLS, session=<a8KWTg1Ez+Qt700O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:56:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<ufbwWQ1EiF8tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 02:59:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<l/IMZA1ECORe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:59:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<EfDFZQ1EdtMrmxBp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 03:00:57 host2 sshd[1876710]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 03:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<VXvBaQ1Eopal0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:01:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<14u+aw1EBogrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 03:02:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<USa2bg1EXouLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 03:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<qKSQig1EmJqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 03:10:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<sXw1jA1EjJkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:10:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<xmFgjQ1E8Mov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 03:13:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<WWmqlg1Ejthm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 03:13:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<M6Rtlw1EgogrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.21
country_id: 2963597
description:
Nov 21 03:15:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=37.203.48.21, lip=66.85.158.91, TLS, session=<32I6nA1EmZ4lyzAV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.1.96
country_id: 2215636
description:
Nov 21 03:15:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=5.63.1.96, lip=66.85.158.91, TLS, session=<o7ltnQ1Ek8IFPwFg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.128.219
country_id: 3469034
description:
Nov 21 03:17:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.92.128.219, lip=66.85.158.91, TLS, session=<1c0hog1EUcuxXIDb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:16:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xNefog1EZucv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 03:17:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<hrMZpA1E3rUFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.174
country_id: 953987
description:
Nov 21 03:17:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=102.129.63.174, lip=66.85.158.91, TLS, session=<zZJZow1EzshmgT+u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 03:18:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<RiX0pg1E4NYvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 03:18:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<CdJYpw1EvJGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 03:19:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<wGiQqg1ECsgv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 03:21:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<bXlfsQ1E2MSElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 03:22:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<y2STtQ1EguZnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Nov 21 03:22:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5Flntg1Ezt7N0h83>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:23:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ToeGuQ1ENuwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 03:23:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<zwd/uQ1Efp0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 03:24:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6nxgvA1E1LVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-11-21 03:27:24 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:56454: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-21 03:27:41 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:51276: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 03:27:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<N+4uyg1EvkMtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:28:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jvZWyg1E4tMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 03:29:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<lu770A1EzOVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 03:31:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Lnj41Q1EKMRnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 03:33:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<DE/33A1ErpItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-11-21 03:34:04 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:65304: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-21 03:34:18 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61469: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 03:36:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<m3OI6A1EeLmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 03:36:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yQ6U6Q1EftCKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 03:38:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<w+dy7w1ENGstTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 03:40:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DPPK9g1EtuwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 21 03:44:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=<noWZBQ5EhMMtQ5ts>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.106
country_id: 2510769
description:
Nov 21 03:45:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=139.28.190.106, lip=66.85.158.91, TLS, session=<26OtBg5E1+iLHL5q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:48:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DbdyEg5E3MIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 03:49:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<hiqvFQ5EapeLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<5w11GA5E+skrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 03:53:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<WAHpJQ5E5I2l0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 03:55:29 host2 sshd[1913696]: Disconnected from invalid user temp 194.107.115.2 port 27150 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 03:55:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<MXR+LQ5EQKCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 03:56:41 host2 sshd[1915186]: Disconnected from invalid user test 204.216.111.140 port 26414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 03:57:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gaxUMw5EqpkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:57:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ci82NQ5EaqIv/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 03:58:58 host2 sshd[1917714]: Disconnected from invalid user spectrum 194.107.115.2 port 35604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:59:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eiVLOQ5EgIkv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.121.27.236
country_id: 3469034
description:
Nov 21 03:59:42 host2 sshd[1918535]: Disconnected from invalid user test 191.121.27.236 port 49212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov 21 04:00:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<C1tBPw5E5s9IPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 04:00:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<joVZPw5E1MgrpAFm>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.195
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.195: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 04:01:18 host2 sshd[1920402]: Disconnected from invalid user test 194.107.115.2 port 34200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-11-21 04:01:54 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:53406: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 04:02:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<JnALRA5Efptm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 04:02:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AmYiRQ5EvOakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 04:04:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<PXjASw5ENOuElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:04:26 host2 sshd[1923762]: Disconnected from invalid user dev 154.88.2.70 port 60370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 04:04:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<1acYTQ5EjJEvWfqZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 04:04:53 host2 sshd[1923974]: Disconnected from invalid user i 204.216.111.140 port 8762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 04:05:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dK4ZUA5E5Lwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 04:05:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<4pbBUA5EVugv+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:07:00 host2 sshd[1926782]: Disconnected from invalid user extern 200.91.236.125 port 57198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.121.27.236
country_id: 3469034
description:
Nov 21 04:07:41 host2 sshd[1927741]: Disconnected from invalid user musicbot 191.121.27.236 port 34842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 04:07:12 host2 sshd[1927064]: Disconnected from invalid user i 194.107.115.2 port 58928 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 04:08:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<5SerWw5ENM4I04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 04:09:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<HRP3XA5EgMxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:09:02 host2 sshd[1929082]: Disconnected from invalid user victor 154.88.2.70 port 56634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:09:55 host2 sshd[1929872]: Disconnected from invalid user miguel 103.161.207.2 port 44960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:10:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<nyO2YA5EJpstTeM5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 04:10:39 host2 sshd[1930906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 04:10:54 host2 sshd[1931159]: Disconnected from invalid user nrk 204.216.111.140 port 28448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 04:11:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<7/7FZA5E0KEFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.100.201
country_id: 798544
description:
Nov 21 04:13:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.100.201, lip=66.85.158.91, TLS, session=<Vy+caw5EhOKy22TJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.61.207.31
country_id: 2510769
description:
Nov 21 04:14:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=5.61.207.31, lip=66.85.158.91, TLS, session=<BM/Ubw5E2J0FPc8f>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:14:57 host2 sshd[1935901]: Disconnected from invalid user ahsan 154.88.2.70 port 40030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.118
country_id: 3469034
description:
Nov 21 04:14:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=187.120.73.118, lip=66.85.158.91, TLS, session=<daodcQ5EyqO7eEl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:15:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<wuJicg5EJqsv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:16:35 host2 sshd[1938078]: Disconnected from invalid user ctl 103.161.207.2 port 39902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 04:18:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<7UlffQ5EqsxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 04:17:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<zkxEeg5EvuJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 04:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<Jzxpew5E6KctPZWl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 04:17:47 host2 sshd[1939116]: Disconnected from invalid user jakayla 62.60.131.157 port 57726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:17:53 host2 sshd[1939184]: Disconnected from invalid user dev 103.161.207.2 port 38886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 04:20:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<z+KxhA5EjKGKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:19:09 host2 sshd[1939963]: Disconnected from invalid user extern 103.161.207.2 port 37870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:19:15 host2 sshd[1940085]: Disconnected from invalid user ctl 200.91.236.125 port 48726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:19:37 host2 sshd[1940478]: Disconnected from invalid user tempuser 154.88.2.70 port 48770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:19:59 host2 sshd[1940853]: Disconnected from invalid user testuser 185.141.132.26 port 48644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:20:29 host2 sshd[1941663]: Disconnected from invalid user dev 200.91.236.125 port 37506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:20:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<UnVthw5E9tYtTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:21:11 host2 sshd[1942208]: Disconnected from invalid user school 45.172.152.74 port 44808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 04:22:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<EQZWjQ5EroqYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:22:39 host2 sshd[1945361]: Disconnected from invalid user richard 87.239.250.247 port 21376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:23:30 host2 sshd[1945756]: Disconnected from invalid user admin 45.78.229.174 port 39486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:23:44 host2 sshd[1945927]: Disconnected from invalid user koha 45.172.152.74 port 58798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-21 04:24:54 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38123: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:24:40 host2 sshd[1946368]: Disconnected from invalid user amin 87.239.250.247 port 57606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:24:54 host2 sshd[1946489]: Disconnected from invalid user user 45.172.152.74 port 48546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:25:15 host2 sshd[1946821]: Disconnected from invalid user repository 185.141.132.26 port 48958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-21 04:25:29 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:38427: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.40.126
country_id: 6252001
description:
[2025-11-21 04:26:09 +0530] info [whostmgrd] 184.164.40.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:28:03 host2 sshd[1948373]: Disconnected from invalid user gituser 185.141.132.26 port 56262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:28:35 host2 sshd[1948746]: Disconnected from invalid user network 45.172.152.74 port 60682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-21 04:29:35 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:53156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-11-21 04:29:47 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:50379: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:29:32 host2 sshd[1949290]: Disconnected from invalid user clouduser 185.141.132.26 port 59840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:31:36 host2 sshd[1950674]: Disconnected from invalid user isaac 45.78.229.174 port 38418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:32:38 host2 sshd[1951281]: Disconnected from invalid user ftpuser 87.239.250.247 port 48768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-11-21 04:33:09 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:49563: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:34:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<eXE6tw5E1istTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:34:41 host2 sshd[1952473]: Disconnected from invalid user nico 87.239.250.247 port 61416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 04:36:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<HXeWvQ5E5pSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 04:36:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<lJ2rwA5ETqormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 04:37:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<41UOxA5E4pkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:38:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lbWQxA5E0tUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 04:38:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<xWy0xg5EgssrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 04:40:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SfhkzA5EuoCYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:40:41 host2 sshd[1956131]: Disconnected from invalid user deployer 87.239.250.247 port 11994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.246
country_id: 3469034
description:
Nov 21 04:42:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.53.107.246, lip=66.85.158.91, TLS, session=<tcu20w5E1+i/NWv2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.243
country_id: 99237
description:
Nov 21 04:42:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.150.243, lip=66.85.158.91, TLS, session=<t4711A5EBJtBFJbz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-21 04:45:06 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:46716: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.155
country_id: 1819730
description:
2025-11-21 04:45:32 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:50532: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:45:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<fpw44A5EXoAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 04:46:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<w4Bz5A5EBrWkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 04:46:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<vllL4g5E9pWl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-11-21 04:46:22 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:45600: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-21 04:46:47 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:46410: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:47:32 host2 sshd[1961227]: Disconnected from invalid user won 45.78.229.174 port 34410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 04:47:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<H6E/6A5EvpsrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.83.214
country_id: 6252001
description:
Nov 21 04:48:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.83.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ztfy6g5EppEUqVPW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-21 04:49:19 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:57623: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-21 04:49:36 dovecot_login authenticator failed for ([179.185.29.233]) [179.185.29.233]:53834: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 04:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<gfyS8g5EhLovWfqZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.111
country_id: 6252001
description:
Nov 21 04:51:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gCFI8w5ErsnN0h9v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 04:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ThFl8Q5EnM5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:52:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<M3uj9g5EouUtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 04:52:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<nglL+A5E0ocv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 04:54:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<V3V5/g5EQpEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:55:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<IBqtAQ9EDuMv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.99.43
country_id: 6252001
description:
Nov 21 04:55:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.99.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yLvqAg9ECrYoTGMr>


