# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:31:39 host2 sshd[485651]: Disconnected from invalid user ipfs 185.193.240.246 port 56734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.141
country_id: 2635167
description:
Nov  8 13:33:11 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.141, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<goS7uhBDN+5X7LCN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.112
country_id: 2635167
description:
Nov  8 13:32:37 host2 dovecot[425774]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.112, lip=66.85.158.92, TLS, session=<9/u1uBBDXZdX7LBw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.111
country_id: 2635167
description:
Nov  8 13:32:38 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.111, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WqG/uBBDxaRX7LBv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.132
country_id: 2635167
description:
Nov  8 13:34:30 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.132, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KM5ovxBDJ9xX7LCE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.65
country_id: 1643084
description:
Nov  8 13:33:49 host2 sshd[487924]: Disconnected from invalid user bench 103.193.178.65 port 32822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.91.226
country_id: 357994
description:
Nov  8 13:34:14 host2 sshd[488368]: Disconnected from invalid user admin 41.33.91.226 port 47628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:34:03 host2 sshd[488179]: Disconnected from invalid user test1 185.193.240.246 port 57850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.125
country_id: 2635167
description:
Nov  8 13:35:03 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.125, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<EH1kwRBDReO594l9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 13:35:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<niijwhBDdNpnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 13:34:48 host2 sshd[488898]: Disconnected from invalid user ubuntu 45.78.202.217 port 49366 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.139
country_id: 2635167
description:
Nov  8 13:36:09 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.139, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RNNYxRBDRcJX7LCL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.134
country_id: 2635167
description:
Nov  8 13:35:36 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vmhfwxBDketX7LCG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Nov  8 13:37:20 host2 sshd[492167]: Disconnected from invalid user amir 202.184.134.84 port 60954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 13:36:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<JfDYxhBDZIEvT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov  8 13:36:43 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XiFWxxBDYcFX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov  8 13:36:47 host2 sshd[491479]: Disconnected from invalid user test001 185.116.160.35 port 37306 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.111
country_id: 2635167
description:
Nov  8 13:37:16 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.111, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<tGJRyRBDu8xX7LBv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Nov  8 13:37:32 host2 sshd[492372]: Disconnected from invalid user office 185.193.240.246 port 59548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.145
country_id: 2635167
description:
Nov  8 13:37:49 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.145, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yu1KyxBD19m594mR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 13:37:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<Rb6OyxBDOImxiOOT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Nov  8 13:38:22 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<xDZGzRBDq71X7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:37:31 host2 sshd[492354]: Disconnected from invalid user dev 187.45.100.0 port 35639 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 13:38:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<7BuXzhBD/r5D2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Nov  8 13:38:50 host2 sshd[493662]: Disconnected from invalid user hsadmin 202.184.134.84 port 59646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 13:38:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<OZFKzxBD1ucBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.235
country_id: 3175395
description:
Nov  8 13:40:25 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=109.70.204.235, lip=66.85.158.91, TLS, session=<D3mg0xBD/tBtRszr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 13:41:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<JX1b1xBD8qql0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:40:39 host2 sshd[495704]: Disconnected from invalid user demo 187.45.100.0 port 59179 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.208.106
country_id: 3175395
description:
Nov  8 13:40:43 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=94.198.208.106, lip=66.85.158.91, TLS, session=<52us1BBD+7hextBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.117.177
country_id: 6252001
description:
Nov  8 13:40:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.117.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8ySA1hBDUpusynWx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 13:45:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<65Ou5RBDLrhD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 13:45:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<2JXT5RBDVubRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 13:45:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<vGnf5hBDOrtnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:46:37 host2 sshd[502677]: Disconnected from invalid user es 187.45.100.0 port 44500 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 13:46:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<RJmL6xBDrItCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 13:47:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<G4hI7BBDHMhIPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 13:47:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<dn2B7hBDaopm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 13:48:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<fXF28BBDJMWP9IUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.45.100.0
country_id: 3469034
description:
Nov  8 13:49:36 host2 sshd[505980]: Disconnected from invalid user aa 187.45.100.0 port 35440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 13:51:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<PZUr+xBDlpRK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 13:51:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Lxgx/BBD2MjRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 13:52:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<VmW1/xBDLl6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 13:54:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<baeHBhFDUN1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 13:55:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<gkjjCRFDZp4v+yzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.210.68.2
country_id: 6252001
description:
Nov  8 13:56:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.210.68.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2NRkDhFD8rqs0kQC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-08 13:59:24 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:38777: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 13:58:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<qKEuFRFDRsxIPGU3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.187
country_id: 1733045
description:
2025-11-08 13:59:53 dovecot_login authenticator failed for ([49.124.148.187]) [49.124.148.187]:57322: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 13:59:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<gBRQGhFDooWxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 14:00:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<iUdBGxFDAtwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 14:01:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<K8K8HhFDNI+l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 14:01:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<flkNIRFDfMc+PIOJ>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-08 14:02:57 H=([102.53.15.17]) [102.53.15.17]:46688 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <mail11@winpukpik777.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 14:03:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<eLlTJRFD2Ktn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 14:04:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<zoV5KRFD9KCi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 14:03:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<cSxiKBFDDlMv7AMK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 14:05:15 host2 sshd[524291]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 14:04:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<uByHKxFDPBy2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 14:08:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<jn8iOBFDPLUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 14:08:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VCH1OBFDHxpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 14:08:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<9st2OhFDvOuOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 14:10:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<VGw4QBFDdL8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 14:12:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<zGLtRRFD7KlnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.108
country_id: 6252001
description:
Nov  8 14:12:21 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.108, lip=66.85.158.92, TLS, session=<OGXQRhFDLu2TuYRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.104
country_id: 3469034
description:
Nov  8 14:11:33 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.154.227.104, lip=66.85.158.91, TLS, session=<IFLaQhFDH7axmuNo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.119
country_id: 798544
description:
Nov  8 14:11:52 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.30.119, lip=66.85.158.91, TLS, session=<pSwBRBFDcZSy2B53>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 14:13:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<JyCBSRFDfBwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 14:13:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Iz7vShFDXMoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 14:14:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<D41aTRFDyIIzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 14:14:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<4/sPTxFDauuP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 14:14:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9crjTxFD9t9m1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 14:15:52 host2 sshd[537513]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 14:16:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<2d9GVBFD2t5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 14:16:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<3DPXVBFDxo9FPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 14:17:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<yoimWBFD/rqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 14:17:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<eIl2WRFD0XcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 14:18:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<N1jhWxFD1OcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 14:18:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<AwlwXRFDBI+zALHl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.103.212
country_id: 1605651
description:
Nov  8 14:18:57 host2 sshd[540767]: Disconnected from invalid user grid 147.50.103.212 port 54358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov  8 14:19:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.49, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ec+HXxFDd8JbxJgx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.254
country_id: 1880251
description:
Nov  8 14:19:19 host2 sshd[541283]: Disconnected from invalid user ftp-test 101.47.140.254 port 37370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.77
country_id: 3017382
description:
Nov  8 14:19:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.77, lip=66.85.158.92, TLS: Connection closed, session=<UPw3YBFD/d9bxJhN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 14:20:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QRRwYxFDKmaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 14:20:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rBPBYxFDasCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 14:19:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<LAZZYBFDir8r4TT5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.54
country_id: 3017382
description:
Nov  8 14:19:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<++H6YBFDI5dbxJg2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.79
country_id: 3017382
description:
Nov  8 14:19:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.79, lip=66.85.158.92, TLS: Connection closed, session=<YhQrYRFDNddbxJhP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:20:30 host2 sshd[542635]: Disconnected from invalid user serv 45.78.202.217 port 45802 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.104.166
country_id: 6252001
description:
Nov  8 14:20:42 host2 pure-ftpd[542946]: (?@172.202.104.166) [INFO] New connection from 172.202.104.166


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.103.212
country_id: 1605651
description:
Nov  8 14:24:29 host2 sshd[547755]: Disconnected from invalid user ai 147.50.103.212 port 39534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 14:23:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<aKfibxFDVL1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 14:25:45 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<fh6UdhFDPr5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 14:27:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<iGIBfBFDfLEBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 14:28:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<4sXufhFDsN5nJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-08 14:30:53 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:43921: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:31:10 host2 sshd[555205]: Disconnected from invalid user martin 45.78.202.217 port 52086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-08 14:31:21 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:42278: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 14:32:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<c+ENjRFDlshK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 14:37:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<KJqPoBFDRMVD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 14:38:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fbiTohFDBqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 14:39:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<bxQ3qBFDwt2xiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 14:40:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<xf1cqxFDJtovT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 14:41:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<UekjrRFDiOjRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-08 14:42:05 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:38381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-08 14:42:15 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:42708: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.115.39
country_id: 2750405
description:
[2025-11-08 14:43:16 +0530] info [cpaneld] 196.251.115.39 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 14:44:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Ibz6txFDNKFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.46
country_id: 3175395
description:
Nov  8 14:45:30 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.15.170.46, lip=66.85.158.91, TLS, session=<7chJvBFDWp25D6ou>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:44:32 host2 sshd[570376]: Disconnected from invalid user park 198.46.249.175 port 50422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 14:44:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<PgJUuxFDOJxm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 14:45:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<16VJvBFDfLdnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-08 14:45:30 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:45947: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.38
country_id: 1269750
description:
Nov  8 14:45:51 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=202.136.85.38, lip=66.85.158.91, TLS, session=<OmN3vRFDva3KiFUm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-08 14:46:00 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:60867: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:46:20 host2 sshd[572884]: Disconnected from invalid user temp 154.91.170.39 port 54480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 14:47:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<TnOawhFDIKCl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 14:47:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<zJIMwxFDLNuP9IUv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.217
country_id: 1880251
description:
Nov  8 14:47:09 host2 sshd[573828]: Disconnected from invalid user ark 45.78.202.217 port 50026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-08 14:47:55 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35008: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-08 14:48:04 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:51542: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:48:36 host2 sshd[575364]: Disconnected from invalid user user1 198.46.249.175 port 36308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 14:49:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=</g/uzBFDyMfRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:49:54 host2 sshd[576664]: Disconnected from invalid user alvaro 154.91.170.39 port 54888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.14.112
country_id: 1643084
description:
Nov  8 14:51:05 host2 sshd[578099]: Disconnected from invalid user jhlee 103.191.14.112 port 59240 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 14:51:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<p3600RFDNIFCYSpH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:52:13 host2 sshd[579349]: Disconnected from invalid user pg 154.91.170.39 port 55154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 14:53:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<hNE52BFDXrEv+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.39
country_id: 241170
description:
Nov  8 14:53:18 host2 sshd[580566]: Disconnected from invalid user marco 154.91.170.39 port 55288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:53:26 host2 sshd[580725]: Disconnected from invalid user me 198.46.249.175 port 48344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 14:54:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gKwL3hFDNIGYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.254
country_id: 1880251
description:
Nov  8 14:54:48 host2 sshd[582433]: Disconnected from invalid user sonar 101.47.140.254 port 37396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov  8 14:56:08 host2 sshd[583972]: Disconnected from invalid user infinity 198.46.249.175 port 59034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 14:56:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<FJU05hFDTqhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 14:57:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8tzV5xFDrIVK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov  8 14:56:45 host2 sshd[584564]: Disconnected from invalid user admin 103.174.115.196 port 57842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov  8 15:00:24 host2 sshd[588772]: Disconnected from invalid user infinity 103.174.115.196 port 53850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 15:02:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<hUlF+hFDsL6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 15:03:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<SnQV/BFDl5m2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 15:02:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<1/cg+hFDTOqxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 15:04:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<WlysAhJDdMIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 15:05:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<NoA+BRJDPMIv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 15:05:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<1Gs0BhJDZLxn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 15:07:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<soSVDRJDbsQv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 15:10:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<EBn/FBJDgYkz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 15:10:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<kIYiFRJDoTtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 15:11:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ZDd2GRJD+t0rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 15:10:40 host2 sshd[602241]: Disconnected from invalid user sheridan 62.60.131.157 port 12538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 15:12:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<MsCQHRJDHIMzTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-11-08 15:12:29 dovecot_plain authenticator failed for (sison) [102.53.15.180]:50773: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 15:13:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<0VOJIBJDEs5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 15:14:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xLkiIxJDsrCP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 15:14:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<CcHsJBJDpLxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 15:14:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kkn5JBJDGJ1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 15:14:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<huc+JhJDwLGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 15:15:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<e9TsJhJDSowv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 15:15:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<V67zKBJDCukBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 15:16:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<8ukuLRJDXN0rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 15:18:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<vyyMMRJDdOiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 15:19:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<5LsnNRJDbpgr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.45
country_id: 3175395
description:
Nov  8 15:19:09 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=185.208.188.45, lip=66.85.158.91, TLS, session=<MsuwNBJDKsu50Lwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.131
country_id: 953987
description:
Nov  8 15:19:31 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.43.131, lip=66.85.158.91, TLS, session=<rXnUNRJDT9JmQCuD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:19:41 host2 sshd[613577]: Disconnected from invalid user william 196.204.240.61 port 36300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 15:22:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<jWe/QBJDgNKzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 15:22:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<M5JrQRJDRoqYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:23:51 host2 sshd[618026]: Disconnected from invalid user dev 196.204.240.61 port 49330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 15:25:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<zeXKSxJDvoJm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  8 15:25:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<wfEXTRJD9rtChJl7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 15:26:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QLIoTxJDIKVnoNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:26:40 host2 sshd[622086]: Disconnected from invalid user new 196.204.240.61 port 32812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 15:27:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<g8rgUhJDTLQ+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov  8 15:28:09 host2 sshd[624223]: Disconnected from invalid user wangrui 196.204.240.61 port 52532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 15:29:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<D3UfWRJDYsNnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-08 15:30:41 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:44282: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-08 15:31:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:33330: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [webmaild] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 15:37:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<njykdRJD1OhD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 15:37:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<GOZadhJDEs3RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 15:38:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<IKXUehJDHuNK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 15:40:55 host2 sshd[638778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 15:41:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<uzv1hRJDCI1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 15:42:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<NqNNiBJDJK5m1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 15:42:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<t8ruiRJDEsaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 15:43:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<wfdfjRJDvI1D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 15:45:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<yiq/khJDULwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 15:46:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<S+nVlRJDlLBnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 15:46:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<6l2tmBJDiImP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Nov  8 15:49:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nP5AoRJDBr5ChJlw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 15:49:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<15W4oRJDrLrRJvZG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 15:51:31 host2 sshd[650398]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 15:51:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<j9N3qBJDzt0v+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 15:52:23 host2 sshd[651327]: Disconnected from invalid user barry 62.60.131.157 port 57364 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 194.163.156.184
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 194.163.156.184: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 15:54:59 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<spy1tRJDBsOl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 15:55:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<LTHruBJDbKei8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 15:56:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<CuTBuRJDetBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 15:56:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<n8xKvBJD4qaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 15:59:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Da0BxRJDGI1A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 15:59:32 host2 sshd[659874]: Disconnected from invalid user pig 43.252.229.25 port 51694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 16:02:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<PkP+zxJDyOu2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:02:30 host2 sshd[663324]: Disconnected from invalid user db 43.252.229.25 port 57986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:04:08 host2 sshd[665627]: Disconnected from invalid user services 175.100.24.139 port 53208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 16:04:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<kLqg1hJDuoBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 16:04:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<HY281hJDXLIBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 16:05:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<uTBi2hJDLNmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 16:05:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GSHh2hJDsIil6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:05:24 host2 sshd[667363]: Disconnected from invalid user staff 43.252.229.25 port 36042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:05:36 host2 sshd[667442]: Disconnected from invalid user v 170.9.0.121 port 39424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:07:00 host2 sshd[669042]: Disconnected from invalid user user1 43.252.229.25 port 39220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 16:06:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<P40O4BJD/7kz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-08 16:07:47 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:37946: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 16:07:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<HJst5BJDkjcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 16:08:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<HZgN5hJDHPIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov  8 16:08:33 host2 sshd[670697]: Disconnected from invalid user elena 43.252.229.25 port 42394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 16:09:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<a2Bi6BJDhqsv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-08 16:08:26 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:33445: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:09:54 host2 sshd[672165]: Disconnected from invalid user guest 202.137.142.115 port 36640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 16:10:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<kE5m6xJD2Mxn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 16:11:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<4eos7xJDltVK0NqG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 16:10:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54375: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 16:10:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Shvm7RJDZoMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 16:10:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<isZT7hJDzxFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:10:18 host2 sshd[672770]: Disconnected from invalid user roman 45.78.198.78 port 54480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 16:10:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kM+A7hJDptAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 16:13:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Ma5h9hJDXOyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 16:12:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<r65i8xJDFpcrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:12:31 host2 sshd[675223]: Disconnected from invalid user guest 175.100.24.139 port 33860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-08 16:12:44 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:40228: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-08 16:13:20 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:38080: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 16:13:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<I1Pf+BJD8t+P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 16:14:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ysTS+RJD9t1m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:14:03 host2 sshd[676809]: Disconnected from invalid user devops 170.9.0.121 port 41040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 16:14:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<A0X0+xJDRqaOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 16:15:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<Kfmv/hJDuLgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.74
country_id: 3469034
description:
Nov  8 16:15:28 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.216.88.74, lip=66.85.158.91, TLS, session=<7AXw/RJDg8m62FhK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.10
country_id: 798544
description:
Nov  8 16:15:45 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.105.10, lip=66.85.158.91, TLS, session=<LJcn/xJD1OVb9mkK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:15:47 host2 sshd[678770]: Disconnected from invalid user zeppelin 45.78.198.78 port 45086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 16:16:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<A+G2ARNDjNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 16:17:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<SL7vBRNDFP4v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 16:18:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<OASTChNDvuwr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 16:18:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<hDj+CRNDWupnoNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Nov  8 16:20:34 host2 sshd[684528]: Disconnected from invalid user ngdc 34.85.163.94 port 46022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:20:53 host2 sshd[684911]: Disconnected from invalid user alvin 175.100.24.139 port 53106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:20:24 host2 sshd[684355]: Disconnected from invalid user vera 202.137.142.115 port 59936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Nov  8 16:22:09 host2 sshd[686542]: Disconnected from invalid user guest 202.137.142.115 port 35606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 16:21:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<KF6DExNDCJNFPkwt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 16:22:14 host2 sshd[686622]: Disconnected from invalid user barry 62.60.131.157 port 10297 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.9.0.121
country_id: 6252001
description:
Nov  8 16:22:19 host2 sshd[686749]: Disconnected from invalid user guest 170.9.0.121 port 57048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  8 16:23:39 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xV1hHBND08pX7LDX>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.78
country_id: 2635167
description:
Nov  8 16:23:38 host2 dovecot[425774]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS, session=<aVVNHBNDT7W594lO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:24:35 host2 sshd[689179]: Disconnected from invalid user tiptop 89.39.246.58 port 39248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.204
country_id: 2635167
description:
Nov  8 16:24:46 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.204, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<XhRYIBNDK6u594nM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 16:24:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<JIV6IBNDCLWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 16:25:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<xhI8IRNDboJm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.184
country_id: 2635167
description:
Nov  8 16:24:13 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.184, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EbRcHhNDPe2594m4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  8 16:25:19 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<WJdTIhND64dX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.206
country_id: 2635167
description:
Nov  8 16:25:52 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.206, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<O9JOJBNDX+tX7LDO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Nov  8 16:26:25 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Hi5IJhNDT81X7LC4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 16:26:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<dx0CKBNDLOyzALHl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.211
country_id: 2635167
description:
Nov  8 16:26:59 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.211, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<il9FKBNDw8G594nT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 16:27:37 host2 sshd[692359]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:27:16 host2 sshd[692178]: Disconnected from invalid user homeassistant 146.190.111.235 port 35586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov  8 16:27:32 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<YcdAKhNDgcxX7LDC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov  8 16:27:57 host2 sshd[692804]: Disconnected from invalid user worker 175.100.24.139 port 40280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.201
country_id: 2635167
description:
Nov  8 16:28:05 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<rSI6LBNDT5e594nJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:28:09 host2 sshd[693067]: Disconnected from invalid user kamil 89.39.246.58 port 56922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.120.227
country_id: 6252001
description:
Nov  8 16:28:32 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.120.227, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CrXYLRNDPLIUqHjj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.196
country_id: 2635167
description:
Nov  8 16:28:39 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<G/ZELhNDVYK594nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 16:29:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<pN5dMRND/MBnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 16:30:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<s5CpNBNDpulnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.246.58
country_id: 798549
description:
Nov  8 16:32:54 host2 sshd[697877]: Disconnected from invalid user smb 89.39.246.58 port 45536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:32:32 host2 sshd[697498]: Disconnected from invalid user omm 154.92.109.196 port 62124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 16:33:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<PPriPxNDHqDRJpe/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.227.110
country_id: 6252001
description:
Nov  8 16:33:44 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.206.227.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9sxyQBNDGuWszuNu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:34:15 host2 sshd[699336]: Disconnected from invalid user postmaster 146.190.111.235 port 33184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:34:18 host2 sshd[699351]: Disconnected from invalid user gerard 154.92.109.196 port 57070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:35:45 host2 sshd[700937]: Disconnected from invalid user cod4server 146.190.111.235 port 59772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.43
country_id: 298795
description:
Nov  8 16:37:02 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=95.0.171.43, lip=66.85.158.91, TLS, session=<LlcxSxNDE6pfAKsr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:37:10 host2 sshd[702466]: Disconnected from invalid user opc 146.190.111.235 port 50296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 16:37:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<wQumTBND8MRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.124
country_id: 798544
description:
Nov  8 16:37:20 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.20.58.124, lip=66.85.158.91, TLS, session=<Zb1LTBNDzIMuFDp8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov  8 16:38:39 host2 sshd[704063]: Disconnected from invalid user wf 146.190.111.235 port 33948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:39:55 host2 sshd[705312]: Disconnected from invalid user rafael 45.78.198.78 port 60378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 16:40:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<x6CpWBNDLsBm1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.78
country_id: 1880251
description:
Nov  8 16:42:36 host2 sshd[708312]: Disconnected from invalid user abbas 45.78.198.78 port 34434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:43:24 host2 sshd[709189]: Disconnected from invalid user chatbot 103.250.10.101 port 57546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 16:43:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<EKr5YxND6oBD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:44:52 host2 sshd[711183]: Disconnected from invalid user isaac 103.250.10.101 port 56264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 16:45:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<Qn3faBNDaOyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.48.162
country_id: 798544
description:
Nov  8 16:44:27 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=31.134.48.162, lip=66.85.158.91, TLS, session=<JtPGZRNDZdUfhjCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.208
country_id: 798544
description:
Nov  8 16:44:45 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.208, lip=66.85.158.91, TLS, session=<Q6zTZhNDDOcu4yfQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Nov  8 16:44:49 host2 sshd[711137]: Disconnected from invalid user user40 154.92.109.196 port 25993 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 16:45:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8nmBaxNDZq9K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 16:46:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Sk6jbBNDSI1nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.101
country_id: 1643084
description:
Nov  8 16:46:17 host2 sshd[712805]: Disconnected from invalid user matin 103.250.10.101 port 60412 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 16:46:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<qw1MbRND+rxnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 16:46:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<beKibhNDkNCP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 16:49:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<DPQXeBNDmITRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 16:49:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<8WJfeRNDzKYv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.52.186
country_id: 2328926
description:
2025-11-08 16:51:34 dovecot_login authenticator failed for (lezzarotech.com) [197.211.52.186]:47657: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 16:52:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<RXSGgxNDUJYBFNmn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 16:54:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wxE6ihNDuIY+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-11-08 16:54:25 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:34996: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 16:54:52 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:60887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 16:58:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<J+/1mRNDZNyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:00:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<BX2voBNDjSC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 17:01:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<3UmmohNDoq1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 17:01:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<OViFpBNDMKxCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 17:03:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<72aHqhND9uwz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 17:03:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<05qkqhNDHo+l0xnK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.255.208.83
country_id: 1814991
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 116.255.208.83 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 17:04:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zgoKrhND+K0vWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov  8 17:06:04 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<BVcNtBND9f7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.39
country_id: 1880251
description:
Nov  8 17:06:57 host2 sshd[736491]: Disconnected from invalid user runner 45.78.222.39 port 38484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.116
country_id: 2464461
description:
2025-11-08 17:07:02 dovecot_login authenticator failed for ([193.95.21.147]) [193.95.24.116]:36832: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-08 17:06:28 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:53980: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:06:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<vt7fthND7KmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 17:07:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<gGWPuBNDBIGl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:07:14 host2 sshd[736909]: Disconnected from invalid user jahan 50.84.211.204 port 60774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 17:08:45 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<w/2IvRNDYs9K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 17:08:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<m+uavRNDooMzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 17:09:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Pv4WvxNDGt4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Fbm7xhNDDqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 17:11:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<AHayxhNDQjJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:11:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<vPNVxxNDzJVK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.175.30.243
country_id: 6252001
description:
2025-11-08 17:12:33 dovecot_plain authenticator failed for c-73-175-30-243.hsd1.pa.comcast.net ([89.116.164.85]) [73.175.30.243]:53920: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.22.125.38
country_id: 6252001
description:
2025-11-08 17:12:44 dovecot_plain authenticator failed for 174-22-125-38.dvnp.qwest.net ([89.116.164.85]) [174.22.125.38]:40675: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.202.4.186
country_id: 3625428
description:
2025-11-08 17:12:55 dovecot_plain authenticator failed for ([89.116.164.85]) [190.202.4.186]:13829: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 17:13:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<JWS9zBND7r4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:13:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<WIPYzhNDzNmP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 17:13:46 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<aTpzzxND+pMrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 17:13:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<l6ozzhNDSt1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 17:14:31 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1MMr0hND8K6PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:14:32 host2 sshd[745499]: Disconnected from invalid user david 50.84.211.204 port 37362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:15:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<3D6u1BND4r5m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov  8 17:15:46 host2 sshd[746949]: Disconnected from invalid user prueba 50.84.211.204 port 38158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-08 17:16:28 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:43744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:16:41 host2 sshd[748000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-08 17:16:50 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:59401: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 17:17:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Fyev2xNDoNcr4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 17:18:49 host2 sshd[750270]: Disconnected from invalid user user 2.57.121.25 port 37743 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:21:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<jz106hNDfMdnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-08 17:23:03 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:54960: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-08 17:23:19 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:59524: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:24:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Ww7S9BNDfMcv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:25:57 host2 sshd[758658]: Disconnected from invalid user test 162.240.156.34 port 54556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 17:26:16 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<LXAl/BND+Ndm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 17:26:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4/sg/BNDJOeYIMkL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 17:27:20 host2 sshd[760473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:28:18 host2 sshd[761624]: Disconnected from invalid user ll 162.240.156.34 port 39536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-08 17:28:45 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:56210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 17:29:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lWJkBhRDJoxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 17:29:39 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Pn5GCBRDJsTRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.106.224.231
country_id: 783754
description:
2025-11-08 17:30:41 dovecot_plain authenticator failed for ([89.116.164.85]) [79.106.224.231]:33614: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:30:49 host2 sshd[764477]: Disconnected from invalid user hesam 162.240.156.34 port 40428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.55.232.113
country_id: 3469034
description:
2025-11-08 17:30:55 dovecot_plain authenticator failed for ([89.116.164.85]) [189.55.232.113]:42284: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 17:33:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<moicFBRDjrJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:34:15 host2 sshd[768111]: Disconnected from invalid user bit 162.240.156.34 port 41712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-08 17:36:22 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:46812: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:36:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<GZAAIRRD5oFD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Nov  8 17:36:39 host2 sshd[771107]: Disconnected from invalid user tesoreria 162.240.156.34 port 42596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 17:37:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nZc/IxRDwI0v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 17:37:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<+miiIxRDQNJm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 17:40:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<tw1fLxRD/oUBFNmn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-08 17:42:25 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:59748: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-08 17:42:47 dovecot_login authenticator failed for erpump.tcil.in [1.7.83.133]:41232: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-08 17:43:08 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:34042: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 17:43:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<yv1+OBRDDI9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 17:45:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<KbhtQhRDoNpnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 17:45:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5W18QhRDfJaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 17:46:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=</vfoQhRDOsGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 17:46:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Y2wYRhRDPp+i8JQo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov  8 17:47:17 host2 pure-ftpd[783057]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 17:47:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<V32lSRRDotUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 17:48:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<TBr3ShRDNJrRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 17:50:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<PkUIUhRDRpxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 17:52:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<gSJHWRRDquBK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-11-08 17:52:38 dovecot_login authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:59652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-08 17:52:54 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:48153: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 17:54:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<USenYhRDYqgvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 17:58:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<WOifbRRDtBe2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.195.248
country_id: 3865483
description:
Nov  8 17:59:51 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.96.195.248, lip=66.85.158.91, TLS, session=<qQhCcxRDiay6YMP4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:00:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2J2LdRRDLi6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.30.227
country_id: 933860
description:
Nov  8 18:00:15 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=83.143.30.227, lip=66.85.158.91, TLS, session=<7BiYdBRDjp5Tjx7j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:00:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</u3ldRRD4qQz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:00:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<bpC7dxRDlFcvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 18:03:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<AXa1fxRDnJ9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 18:05:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<3FXqiRRD0JpK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 18:06:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<ZiyXihRDEtlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 18:07:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<bpQNjhRD3IMzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 18:07:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sOcVkBRDiqil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:07:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<OWpQkBRD+JOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:07:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lMRpkBRDMqWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 18:09:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xURclRRDot4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 18:10:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zxtsmRRDegRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 18:10:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EIsFmxRDmJOPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 18:10:55 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<rm3bmxRDWsSl0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:14:11 host2 sshd[815648]: Disconnected from invalid user perry 62.60.131.157 port 41358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 18:13:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<B9qfphRDjtArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 18:15:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Tyn6qhRD4O1n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:15:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<SCAsrBRDsqdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 18:15:30 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<5ZE7rBRDPJIr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-08 18:15:37 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (caraele) [71.41.202.12]:35243: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:16:29 host2 sshd[818167]: Disconnected from invalid user admin 203.154.162.65 port 50234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<8VDrsRRD/OVK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:17:43 host2 sshd[819617]: Disconnected from invalid user ian 203.154.162.65 port 49278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-08 18:17:53 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:53862: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-11-08 18:18:08 dovecot_login authenticator failed for ([182.79.85.38]) [182.79.85.38]:46444: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-08 18:18:25 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:48234: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 18:18:34 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:53207: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:20:13 host2 sshd[822427]: Disconnected from invalid user devops 203.154.162.65 port 47374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 18:20:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<E+I6vRRDGIiOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.154.162.65
country_id: 1605651
description:
Nov  8 18:23:53 host2 sshd[826279]: Disconnected from invalid user ts3 203.154.162.65 port 44526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:24:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ygLKyhRD2MlnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 18:25:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<oP040RRD4p3RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 18:26:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c99+0xRDANNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 18:27:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Srz01xRDDjmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 18:28:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Zo172RRDFspnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 18:28:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=</dMA2xRDVOcBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 18:34:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<3fqh7hRDMuRm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov  8 18:35:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<VikU9RRDBpKnXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 18:35:57 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vVVn9RRDbJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:36:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<HKe39xRDPphD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 18:43:04 host2 sshd[848310]: Disconnected from invalid user perry 62.60.131.157 port 40105 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 18:43:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<+hFCDxVDXtlD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 18:43:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZPv6DxVDGIdnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-08 18:43:48 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:53192: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-08 18:44:23 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:51858: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 18:44:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jxiSExVDuuyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 18:46:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<fKt5HBVDXpcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 18:46:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<VB3MHBVDPoOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 18:47:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<ZCZZHRVDTJvRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 18:51:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5k5DLRVDojEv7AMK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.65.236.131
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.65.236.131 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 18:52:55 host2 sshd[860511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 18:54:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fJTwNxVDiq9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 18:55:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<GwmwOxVDSPq2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 18:56:16 host2 sshd[864700]: Disconnected from invalid user kevin 101.47.161.161 port 39740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 18:57:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<YJCKQRVDqJFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<3K8NQBVDp/ovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 18:56:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<J7AXQBVDfckz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 18:59:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<RN+6ShVDNNIvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 18:59:57 host2 sshd[868564]: Disconnected from invalid user user 2.57.121.25 port 41572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-08 19:01:14 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:50210: 535 Incorrect authentication data (set_id=mail@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:02:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hprMUhVDRleYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:02:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Yj8IVBVDFNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:02:36 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<v2+uVBVDIrlK0NqG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:03:39 host2 sshd[873632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.161
country_id: 1880251
description:
Nov  8 19:04:26 host2 sshd[874572]: Disconnected from invalid user tidb 101.47.161.161 port 60836 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 19:04:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<LnA/XBVDzMFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 19:04:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<WIWgXBVDDIQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:05:27 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nFPmXhVDBpaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 19:06:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mqWMYhVDTqal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 19:06:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<5DoYZBVDdgUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 19:07:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LkVPZhVDxSJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:09:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<dbnkaxVDCrOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 19:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<2j0BbBVDmNYv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 19:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Ctu1bBVDysdCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:10:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Zb5FcBVDKIqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 19:10:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<IShfcBVDZrcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 19:13:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<ARMXfRVDhLor4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 19:14:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2NWzfxVDBN8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 19:16:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<OGd/hRVDANgBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 19:16:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=</V6UhxVDgrSl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:16:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<a1lThhVDLthm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 19:19:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<bdQWkRVD5I9n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 19:22:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<tGfymhVDjpZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 19:21:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Rj61mRVDTt7RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 19:22:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<Cc4NnBVD8LOOtOyP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:24:48 host2 pure-ftpd[897276]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 19:26:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<urBXqhVDzKRnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 19:27:35 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C44PrhVDBuhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:28:17 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<14CRsBVDHpFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 19:29:59 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4G+ZthVDYGKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 19:30:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<ZD1YuBVD4odm1PbI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.141.154
country_id: 2328926
description:
Nov  8 19:30:54 host2 pure-ftpd[903980]: (?@152.32.141.154) [INFO] New connection from 152.32.141.154


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 19:35:15 host2 sshd[908080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:35:08 host2 sshd[908411]: Disconnected from invalid user doris 27.254.235.2 port 35162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:36:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<qHgszxVDGuRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 19:37:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<Hask0BVD4pai8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 19:40:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<kkjc2xVDqo1noNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:41:05 host2 sshd[915119]: Disconnected from invalid user sina 27.254.235.2 port 54054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 19:42:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<RziT4RVDiOtnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 19:43:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lp/S5hVDlIND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 19:43:50 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ziIh6BVDpJ2P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-08 19:43:53 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:53270: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-08 19:44:02 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:64772: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-08 19:44:20 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:59415: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 19:44:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<bjwd6xVDIOLRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 19:46:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<rcjo7xVDgK4v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 19:48:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<o2I7+RVD9pyxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  8 19:51:00 host2 sshd[926026]: Disconnected from invalid user newuser 27.254.235.2 port 47358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 19:52:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<EdMTBxZD6ZIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 19:53:06 host2 sshd[928390]: Disconnected from invalid user alexys 62.60.131.157 port 35074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 19:53:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<fueMCRZDM4Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 19:54:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<8bjPDRZDbVu2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-11-08 19:56:04 dovecot_plain authenticator failed for (diese) [65.20.163.103]:47010: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 19:57:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3ebhFxZDmqyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 19:58:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ytS+HRZDMqFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:00:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lDJVIhZDHOePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 19:59:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<EMKmHxZDtNVK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 19:59:26 host2 sshd[935113]: Disconnected from invalid user user 2.57.121.25 port 41715 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:00:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LbzuJBZDZsOi2JXJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:01:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gVzbJhZDouqi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:02:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<oWSfKRZDSoQzTY0d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  8 20:02:41 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DG+2KxZDqOdChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:03:02 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<XDnRLBZDauVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:04:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<bqFuMBZDtsoBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 20:04:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<XxGNMRZDap0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:04:40 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8JyrMhZD9ICYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 20:05:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61799: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 20:05:18 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oZbtNBZDqh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 20:06:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cxUDOhZDDI+l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:06:44 host2 sshd[943124]: Disconnected from invalid user julius 2.113.74.42 port 51290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 20:08:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<QECPPhZD6IkrZDwA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.201
country_id: 6252001
description:
Nov  8 20:08:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.201, lip=66.85.158.91, TLS, session=<hnFRPxZDjvSi2JXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:09:09 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<wA62QhZDoraP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 20:09:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<26mMQhZDxtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 20:09:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Z15IRRZDoMlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:10:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<NmVHSBZDOMuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 20:11:29 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<h6ENSxZDWItCYSpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:11:37 host2 sshd[948429]: Disconnected from invalid user orca 168.167.228.74 port 35318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov  8 20:12:29 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<Czq1ThZDLtkjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:13:19 host2 sshd[950183]: Disconnected from invalid user max 168.167.228.74 port 35319 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-08 20:14:28 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:33703: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:14:59 host2 sshd[951805]: Disconnected from invalid user init 122.166.49.42 port 50190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-08 20:15:01 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:58303: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 20:15:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Uo/CWBZDqqUr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 20:15:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<zhUPWxZDlNcrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:16:22 host2 sshd[953449]: Disconnected from invalid user webmaster 2.113.74.42 port 51254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:17:07 host2 sshd[954191]: Disconnected from invalid user netbox 45.78.216.103 port 47618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:17:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<NiSiXxZD/Ndm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:21:06 host2 sshd[958758]: Disconnected from invalid user rsyncuser 168.167.228.74 port 35324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.113.74.42
country_id: 3175395
description:
Nov  8 20:21:09 host2 sshd[958775]: Disconnected from invalid user test_user 2.113.74.42 port 46892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:21:26 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<q0yZbhZDCKAv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:22:23 host2 sshd[960082]: Disconnected from invalid user debian 45.78.216.103 port 40300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 20:22:53 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<sVC9cxZDir6l0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:23:49 host2 sshd[961498]: Disconnected from invalid user mohammed 103.59.94.124 port 40222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  8 20:24:48 host2 sshd[962389]: Disconnected from invalid user api_user 122.166.49.42 port 35578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 20:24:28 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<skB5eRZDVqBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 20:25:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<7yaifBZDZruOtOyP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Nov  8 20:25:52 host2 sshd[964154]: Disconnected from invalid user sagar 168.167.228.74 port 35327 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 20:27:00 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<5gGGghZD7plm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 20:28:10 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<n522hhZDONRm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 20:28:25 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<Rv+QhxZDpJ5K4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:29:44 host2 sshd[968227]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.202
country_id: 6252001
description:
Nov  8 20:31:13 host2 pure-ftpd[970020]: (?@195.184.76.202) [INFO] New connection from 195.184.76.202


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.204
country_id: 6252001
description:
Nov  8 20:31:12 host2 pure-ftpd[970004]: (?@195.184.76.204) [INFO] New connection from 195.184.76.204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:31:23 host2 sshd[970379]: Disconnected from invalid user raul 103.59.94.124 port 34324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:32:47 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<hYI3lxZDquhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 20:32:38 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hw6plhZDJoyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 20:34:07 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<vTvzmxZDhGQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 20:34:12 host2 sshd[973768]: Disconnected from invalid user baby 62.60.131.157 port 34869 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Phh6phZDfqpD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:37:45 host2 sshd[977830]: Disconnected from invalid user daniil 103.59.94.124 port 52288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 20:39:52 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3DWRsBZDotmP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.124
country_id: 1643084
description:
Nov  8 20:39:18 host2 sshd[979422]: Disconnected from invalid user user 103.59.94.124 port 45434 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 20:40:32 host2 sshd[980773]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 20:40:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<mk9XshZDurNnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 20:42:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<6isruhZD9LnRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:42:52 host2 sshd[983005]: Disconnected from invalid user webmaster 45.78.216.103 port 55488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 20:43:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<lslSvhZD3rFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 20:44:56 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<pRyjwhZDpLJnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.103
country_id: 1880251
description:
Nov  8 20:45:28 host2 sshd[986233]: Disconnected from invalid user test_user 45.78.216.103 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 20:45:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Myp5xRZDUsov+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 20:47:49 host2 sshd[988647]: Disconnected from invalid user wang 102.176.81.29 port 49266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 20:48:34 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<HC+lzxZDox4vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 20:49:54 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dKlr1BZDsaUz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 20:51:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<Jfml2BZDbrsBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:51:11 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uPUE2RZD9JqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 20:50:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<y1kJ1hZDaJexiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:51:26 host2 sshd[992460]: Disconnected from invalid user njs 81.30.162.18 port 46869 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:52:41 host2 sshd[993778]: Disconnected from invalid user harry 81.30.162.18 port 60550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 20:53:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CIsB4hZDgrK2uHYF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Nov  8 20:53:59 host2 sshd[995141]: Disconnected from invalid user sebastian 81.30.162.18 port 45995 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 20:54:08 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hiGQ4xZDjs6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 20:55:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<gBKE6RZDML5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 20:59:33 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<64ns9hZDhoQzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 21:02:06 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TMcIABdDIzdniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.137
country_id: 2635167
description:
Nov  8 21:02:25 host2 pure-ftpd[1004344]: (?@87.236.176.137) [INFO] New connection from 87.236.176.137


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 21:02:31 host2 sshd[1004485]: Disconnected from invalid user baby 62.60.131.157 port 46912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:02:40 host2 sshd[1004605]: Disconnected from invalid user dev 102.176.81.29 port 42436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 21:03:22 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2qaPBBdDeKlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 21:04:12 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fzyOBxdDALGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Nov  8 21:04:13 host2 sshd[1006626]: Disconnected from invalid user njs 102.176.81.29 port 46502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:05:06 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:58264: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 21:05:49 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<XUtZDRdDwKgrZDwA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Nov  8 21:06:05 host2 pure-ftpd[1009107]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-08 21:05:23 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:54532: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:05:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xqS0CxdDnJqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:07:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hkN0EhdDYKqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 21:09:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uST+GBdDGJYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 21:08:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<4liiGBdDoso+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 21:09:19 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<NOHgGRdDJtUv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:09:20 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<W1joGRdDFKFK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:11:51 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<69XxIhdD2r0+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 21:13:43 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Yv+TKRdDjs1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 21:14:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<D+XCKhdDmo9CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 21:17:05 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2BSeNRdD+r0rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 21:16:13 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<s2aQMhdDQo4r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 21:16:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<TqgZMxdDONM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:17:58 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<krvKOBdDFMBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 21:23:21 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<EGwLTBdDAKxm1PbI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:03 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ucFCUhdD4NFBMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 21:25:22 host2 dovecot[425774]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oB9cUxdDPuxBMQGs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 21:26:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<EWT/VxdD1LBn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 21:27:32 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<324GWxdDzuCi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 21:27:48 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<iIT8WxdDUq2OtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 21:29:04 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<fY+DYBdD/uxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 21:29:23 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<RNmgYRdDTKul0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-08 21:33:13 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:33550: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-08 21:33:35 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:54518: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-08 21:34:31 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:57014: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 21:34:44 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uGa+dBdDQudK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 21:35:15 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Pb2bdhdDprWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 21:36:24 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<jAS9ehdD2uGP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  8 21:36:31 host2 dovecot[425774]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<U8xCexdDj/7CpRCl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:36:52 host2 sshd[1043041]: Disconnected from invalid user user1 152.32.129.136 port 54972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 21:37:03 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<RaIOfRdDXsVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 21:38:14 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<SD9JgRdDVqwBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 21:37:37 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<7fsUfxdDCIRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 21:38:42 host2 dovecot[425774]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ia/rghdDlIJnVK2y>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:39:46 host2 sshd[1046068]: Disconnected from invalid user flex 152.32.129.136 port 15286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov  8 21:40:16 host2 dovecot[1045703]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<fvysiBdD/LO4aYtF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 21:40:41 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<a9IPihdDxqvRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 21:44:17 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<CrLslhdDooFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 21:44:57 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<x+o3mRdDpncvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Nov  8 21:44:58 host2 sshd[1071464]: Disconnected from invalid user ospite 152.32.129.136 port 43466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 21:45:30 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nrNDmxdD9J2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 21:45:51 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<46R+nBdDjLcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 21:46:56 host2 dovecot[1045703]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<DjNcoBdDEMsz0msW>


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Nov  8 21:48:53 host2 dovecot[1078594]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 21:49:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<0R97qBdDVIhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 21:50:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<URx3qxdDkA0v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 21:52:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<zkcjsxdDYLuxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 21:52:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<TQa+sxdDdtNK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 21:53:58 host2 sshd[1084518]: Disconnected from invalid user ubuntu 45.249.247.86 port 53068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-08 21:54:26 dovecot_plain authenticator failed for (unifistum) [65.20.204.193]:44595: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 21:54:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<h2g0uxdD5Lq2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-08 21:57:00 dovecot_plain authenticator failed for (undly) [65.20.204.193]:49806: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 21:57:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<0LgSxRdDuoQzTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 21:58:06 host2 sshd[1089364]: Disconnected from invalid user depot 45.249.247.86 port 42218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-08 21:58:15 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:38540: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-11-08 21:57:56 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:48269: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 21:59:07 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Yx3zyxdDdglniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 22:01:28 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JJdb1BdD1ISl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:01:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<XEC91RdDgLGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 22:03:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nOiX2hdDctAv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.33
country_id: 6252001
description:
Nov  8 22:03:48 host2 pure-ftpd[1109066]: (?@198.235.24.33) [INFO] New connection from 198.235.24.33


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 22:03:57 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<kkA33RdDPtkrZDwA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.86
country_id: 1819730
description:
Nov  8 22:04:05 host2 sshd[1109406]: Disconnected from invalid user afzal 45.249.247.86 port 58770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 22:06:40 host2 sshd[1112389]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 22:07:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9MXj6hdD4K1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 22:09:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<woac8BdD1Ikv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 22:10:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<DpcH8xdDBNSYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.101
country_id: 6252001
description:
Nov  8 22:10:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.155.101, lip=66.85.158.92, TLS: Connection closed, session=<gpqs9BdD4JrHLZtl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  8 22:10:45 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<UdW09RdDTp6UccFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-08 22:12:24 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:41952: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.151.205
country_id: 1880251
description:
2025-11-08 22:12:35 dovecot_login authenticator failed for bb116-14-151-205.singnet.com.sg [116.14.151.205]:47789: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 22:11:54 host2 sshd[1118196]: Disconnected from invalid user kacey 62.60.131.157 port 15076 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 22:14:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<XWdHAhhDdJaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 22:13:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<w43GABhDtqEvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-08 22:15:20 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (suconeys) [68.60.77.128]:38170: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 22:15:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<uOASCBhDfJBK4fqm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 22:17:21 host2 sshd[1124563]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 22:16:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<J+ePCxhD5LNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 22:17:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QXKuDBhDZOwr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 22:17:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wabXDhhDBOBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 22:18:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<YxpwEBhDFtMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 22:19:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<AGUtFBhDDp1m1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:20:06 host2 sshd[1127410]: Disconnected from invalid user mahdi 177.229.197.38 port 36436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 22:20:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<f7EtGBhDAL5m1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:21:34 host2 sshd[1128783]: Disconnected from invalid user rain 177.229.197.38 port 56540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov  8 22:24:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<koPfJRhDdg5APpy2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.191
country_id: 6252001
description:
Nov  8 22:23:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<owPJJBhD7fBAPpy/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 22:25:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<g/5wKxhDfp4BFNmn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Nov  8 22:27:04 host2 sshd[1134717]: Disconnected from invalid user justine 177.229.197.38 port 57646 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 100.26.106.240
country_id: 6252001
description:
Nov  8 22:27:54 host2 pure-ftpd[1135437]: (?@100.26.106.240) [INFO] New connection from 100.26.106.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:27:58 host2 sshd[1135618]: Disconnected from invalid user webadmin 107.173.127.215 port 42194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 22:28:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<s8jDNBhDUMFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 22:30:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<LqFePBhD/rNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 22:31:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<5OUGPxhDEpOOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:31:49 host2 sshd[1139657]: Disconnected from invalid user ec2-user 107.173.127.215 port 57050 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 22:32:41 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<CjEFRBhDFq0+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.241
country_id: 1819730
description:
Nov  8 22:32:42 host2 sshd[1140822]: Disconnected from invalid user webadmin 118.26.36.241 port 40816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:33:17 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<8QckRhhDDKWP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov  8 22:34:31 host2 sshd[1142815]: Disconnected from invalid user ac 185.158.23.150 port 8885 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.127.215
country_id: 6252001
description:
Nov  8 22:34:25 host2 sshd[1142732]: Disconnected from invalid user mary 107.173.127.215 port 56786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 22:35:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<OXwKTxhD4Kel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 22:36:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<Rt4fURhDkOVnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 22:36:41 host2 sshd[1145411]: Disconnected from invalid user administrator 197.134.250.149 port 53476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov  8 22:37:38 host2 sshd[1146467]: Disconnected from invalid user test_user 185.158.23.150 port 6501 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.161
country_id: 6252001
description:
Nov  8 22:37:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.161, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rgwyVhhD+U9APpyh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov  8 22:38:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zTFHVxhDyBFAPpyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 22:38:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UZZqWBhDPt+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 22:38:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<ry5/WBhD8s9D2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 22:38:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<jtteWhhDjKbRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 22:40:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<SySaXxhDLNOPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.254.83
country_id: 357994
description:
Nov  8 22:41:47 host2 sshd[1150985]: Disconnected from invalid user erp 197.134.254.83 port 36717 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov  8 22:41:49 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WWzMZBhDzJ5ChJl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 22:41:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QXs5YxhDOqBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 22:41:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<QUMhZBhDNp9K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 22:41:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<u41BZBhDYb8vWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Nov  8 22:43:10 host2 sshd[1152633]: Disconnected from invalid user james 155.4.244.107 port 56908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 22:43:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<riU6ahhD0pGPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:43:57 host2 sshd[1153473]: Disconnected from invalid user simon 103.153.110.189 port 50360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 22:44:27 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<i3YZbhhDo+gz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 22:44:58 host2 sshd[1154836]: Disconnected from invalid user hyperspace 196.221.165.62 port 64120 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 22:45:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<kUCXcBhDjMND2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:45:26 host2 sshd[1155793]: Disconnected from invalid user mas 103.153.110.189 port 56512 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.163.139
country_id: 2658434
description:
Nov  8 22:46:10 host2 pure-ftpd[1156692]: (?@35.216.163.139) [INFO] New connection from 35.216.163.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.204.150
country_id: 357994
description:
Nov  8 22:46:32 host2 sshd[1157202]: Disconnected from invalid user builder 196.221.204.150 port 19954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 22:46:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<W4didhhDgo0v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-08 22:46:03 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:35604: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.163.139
country_id: 2658434
description:
Nov  8 22:46:05 host2 pure-ftpd[1156629]: (?@35.216.163.139) [INFO] New connection from 35.216.163.139


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Nov  8 22:47:01 host2 sshd[1157731]: Disconnected from invalid user ubuntu 103.153.110.189 port 58088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-08 22:47:04 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:65152: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 22:49:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<zdf7fhhD1MBK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 22:49:51 host2 sshd[1161036]: Disconnected from invalid user oracle 197.134.250.149 port 52460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.178
country_id: 6252001
description:
Nov  8 22:50:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.178, lip=66.85.158.91, session=<piZggxhDpaBBMQGy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:50:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<feyRgxhDuokDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Nov  8 22:50:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS: Connection closed, session=<yKwahBhDwH1BMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:51:09 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<1sgqhhhD3KsDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 22:51:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<1TsyhxhDoNk+PIOJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:52:09 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<gxC6iRhDgIsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:52:58 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<R4+rjBhDKLQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-11-08 22:53:23 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:50192: 535 Incorrect authentication data (set_id=careers@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 22:53:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vRmrjhhDkNZnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.54
country_id: 1733045
description:
2025-11-08 22:53:54 dovecot_login authenticator failed for ([49.124.149.54]) [49.124.149.54]:45706: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:53:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GegEkBhDnoYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 22:54:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<//OHkxhDvqKxiOOT>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:55:46 host2 dovecot[1078614]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<8iWwlhhDLLwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 22:55:59 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Dz5blxhDjHu2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 22:57:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<T2tgnBhDGyVniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:57:35 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<diAonRhDhIADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 22:57:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<kPpMnhhD7K+P9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 22:58:15 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<71OSnxhDet4DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.212.214.10
country_id: 357994
description:
Nov  8 22:59:47 host2 sshd[1172460]: Disconnected from invalid user sammy 213.212.214.10 port 18984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 22:59:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+t0FpBhD4uWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 23:01:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<4J4IqxhDmIIrZDwA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.204.150
country_id: 357994
description:
Nov  8 23:01:32 host2 sshd[1174846]: Disconnected from invalid user srv 196.221.204.150 port 35243 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov  8 23:03:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<fJP8sRhDDJlChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:05:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+004uRhDiNyTuYWr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:06:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<D1KAvBhDBveTuYWr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.38.76
country_id: 357994
description:
Nov  8 23:09:46 host2 sshd[1185226]: Disconnected from invalid user tino 196.221.38.76 port 51010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 23:09:52 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=</tD6yBhDzMsv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-08 23:11:24 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:59656: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:11:27 host2 sshd[1187469]: Disconnected from invalid user james 196.221.165.62 port 62162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov  8 23:11:29 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<zJbkzhhDAreUccFP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.171
country_id: 6252001
description:
Nov  8 23:12:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.171, lip=66.85.158.92, TLS, session=<Jczr0BhDAOCTuYWr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 23:12:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5XnA0xhDiptnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 23:13:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<xpah1RhDHCeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 23:13:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<CV7n1RhDqJABFNmn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.134.250.149
country_id: 357994
description:
Nov  8 23:14:55 host2 sshd[1191142]: Disconnected from invalid user ts3server 197.134.250.149 port 34269 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-11-08 23:16:08 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (slawete) [73.171.230.200]:37065: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:16:32 host2 sshd[1192942]: Disconnected from invalid user max 196.221.165.62 port 50522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.187
country_id: 6252001
description:
Nov  8 23:16:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.187, lip=66.85.158.92, session=<YMUQ4hhDCwlAPpy7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Nov  8 23:17:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS: Connection closed, session=<wRjg4hhDFm1APpy2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 23:17:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<ZAir5BhDxOyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 23:18:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<a75Q5xhD7M9m1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 23:18:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<a7226BhDsNcr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 23:19:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<ixEE6hhD9OwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.161
country_id: 798544
description:
Nov  8 23:19:41 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=91.240.44.161, lip=66.85.158.91, TLS, session=<9Uk36xhDSM1b8Cyh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 23:20:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ymQe7xhD4qArmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.221.38.76
country_id: 357994
description:
Nov  8 23:19:54 host2 sshd[1196669]: Disconnected from invalid user ac 196.221.38.76 port 17509 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 23:20:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<K15M7RhDkptm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.109.56.74
country_id: 3469034
description:
Nov  8 23:20:01 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=179.109.56.74, lip=66.85.158.91, TLS, session=<QjVc7BhDkMuzbThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 23:20:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Xn9a7hhD/oRCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 23:21:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<1DCs8hhDMHkv7AMK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.221.165.62
country_id: 357994
description:
Nov  8 23:21:35 host2 sshd[1198527]: Disconnected from invalid user localhost 196.221.165.62 port 33765 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 23:22:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<3tyl9BhDKs2i8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 23:23:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<A8Op+BhDILhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 23:23:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<rcCG+RhD7rxK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.153.132.112
country_id: 1269750
description:
Nov  8 23:22:54 host2 sshd[1199821]: Disconnected from invalid user proxyuser 20.153.132.112 port 34782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Nov  8 23:26:22 host2 sshd[1203685]: Disconnected from invalid user sepehr 190.153.249.99 port 41749 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 23:29:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Au6lDhlDYN+P9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:29:22 host2 sshd[1206798]: Disconnected from invalid user soksuser 43.133.185.172 port 44150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:30:43 host2 sshd[1208529]: Disconnected from invalid user mark 43.133.185.172 port 33136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 23:30:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<qbiCERlDvNFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 23:31:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9fsWFRlDgLZm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-08 23:31:22 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:49713: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-08 23:31:06 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:43714: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:33:27 host2 sshd[1211499]: Disconnected from invalid user root1 43.133.185.172 port 37916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  8 23:34:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<39qrHxlDIQjCpRCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 23:34:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<KtzCIBlD2OhnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 23:35:39 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Hj8uJRlDzNaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 23:35:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<kQ1gJRlD4kEv7AMK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.189.114.125
country_id: 719819
description:
Nov  8 23:35:50 host2 pure-ftpd[1214326]: (?@185.189.114.125) [INFO] New connection from 185.189.114.125


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.89.117
country_id: 660013
description:
Nov  8 23:35:53 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.126.89.117, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jEgfJhlDtp+8fll1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.9
country_id: 3895114
description:
Nov  8 23:35:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.11.9, lip=66.85.158.91, session=<sMgeJhlDepOSRgsJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.142
country_id: 2802361
description:
Nov  8 23:35:52 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=181.214.218.142, lip=66.85.158.91, session=<iN8bJhlDfpO11tqO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Nov  8 23:37:09 host2 sshd[1215815]: Disconnected from invalid user mapadmin 107.173.10.71 port 59716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov  8 23:37:13 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fFTwKhlDbv8t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.185.172
country_id: 1861060
description:
Nov  8 23:37:19 host2 sshd[1216068]: Disconnected from invalid user rta 43.133.185.172 port 35054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 23:37:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<nrwYLBlDLKrRJvZG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Nov  8 23:38:50 host2 sshd[1217513]: Disconnected from invalid user odoo 190.153.249.99 port 48440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 23:38:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Srb5LxlDXpqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 23:39:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<R6KOMhlDKw0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 23:39:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<++ukMhlDtqZD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 23:42:26 host2 sshd[1221921]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 23:42:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<dDJJPBlDrjKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 23:43:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<81n6PxlDZZYz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 23:44:10 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ntqnQxlD/sM+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Nov  8 23:43:55 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.91, session=<jonnQhlDLChBMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 23:44:52 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<qCAgRhlDvOFK0NqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Nov  8 23:45:25 host2 dovecot[1078614]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.92, session=<kOI9SBlDnoes7ORv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 23:45:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<e2WGSBlDitpD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 23:45:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<WqyySRlD6thnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 23:47:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<DxHiThlD8uSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-08 23:48:17 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:37096: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 23:47:57 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Ee4nURlDiOwv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.194
country_id: 1733045
description:
2025-11-08 23:49:00 dovecot_login authenticator failed for ([49.124.159.194]) [49.124.159.194]:34608: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 23:49:27 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<5heIVhlDNrVK4fqm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.63.209
country_id: 2802361
description:
Nov  8 23:49:30 host2 pure-ftpd[1230852]: (?@34.140.63.209) [INFO] New connection from 34.140.63.209


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 23:53:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<MpOjZBlDPuGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 23:55:05 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zr2qahlDNUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 23:55:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<DJwEbRlD87i2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 23:56:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<G7m9bhlDfrGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 23:56:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<kfjPcBlDXpil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 23:56:14 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<hH/NbhlDRtYrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 23:58:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<8o1YdhlD8rs+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 23:58:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<CAAfdRlDssxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 00:05:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<2b60jhlD0qc+PIOJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.118
country_id: 3017382
description:
Nov  9 00:07:15 host2 pure-ftpd[1252401]: (?@91.196.152.118) [INFO] New connection from 91.196.152.118


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.24
country_id: 3017382
description:
Nov  9 00:07:16 host2 pure-ftpd[1252479]: (?@91.196.152.24) [INFO] New connection from 91.196.152.24


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 00:10:43 host2 sshd[1256399]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 00:10:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<IShKohlDZMAv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 00:14:19 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<4Cp1rxlDCNkr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-09 00:14:22 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:46476: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-09 00:14:32 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:40603: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 00:15:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<oZ1isxlDArRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 00:16:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<fw44txlD6uFm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 00:17:08 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<VqiGuRlD9JyxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 00:17:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<kivhuxlDvFGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 00:19:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<w1v0wRlDyI1m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 00:21:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<rXclyRlDPolCYSpH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 00:21:16 host2 sshd[1269204]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 00:23:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<lBd2zxlDTICP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 00:23:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<30KH0RlDrqormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.101
country_id: 798544
description:
Nov  9 00:24:26 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=212.59.224.101, lip=66.85.158.91, TLS, session=<9LXI0hlDTKXUO+Bl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.185
country_id: 798544
description:
Nov  9 00:24:45 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.247.185, lip=66.85.158.91, TLS, session=<E5fg0xlDSa5tffe5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-09 00:24:50 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:40862: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-11-09 00:25:05 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:39670: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 00:25:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DP492BlDeLlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 00:27:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<wgeu3hlDPuxnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 00:30:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mOG96RlD/M9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 00:31:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<KI1n7BlDWsSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 00:31:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<02P+7RlD+K5K4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 00:31:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<koIT7hlDMOJn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.39
country_id: 2921044
description:
Nov  9 00:34:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=139.59.136.39, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<I0ws9hlDZ3WLO4gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-11-09 00:33:56 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:45099: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.136.39
country_id: 2921044
description:
Nov  9 00:34:10 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=139.59.136.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<SNKR9hlDpROLO4gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-11-09 00:34:18 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:34600: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 00:34:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Rb8/9xlDpr6PbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.30.169
country_id: 2921044
description:
Nov  9 00:34:39 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.30.169, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ic1I+BlDeEyd5h6p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-09 00:34:55 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:40636: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 00:36:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Mcld/hlDHpND2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 00:36:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<VqOk/xlDJpzRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 00:37:44 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56839: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 00:38:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<axYtBBpDFFUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 00:38:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<sp2MBRpDgoRK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 00:42:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<mB2rEhpDSqoz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 00:43:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<28cCFxpDKotD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.126
country_id: 6252001
description:
Nov  9 00:44:05 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<degMGhpDzMgUQGl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 00:46:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qRyZIxpDfl2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 00:47:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<rKSBJhpDPteP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 00:47:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<a1LxJhpDjNAv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 00:49:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<EnwLLBpDCJcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 00:50:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<XpN4MBpDKOwrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.201
country_id: 1733045
description:
2025-11-09 00:50:52 dovecot_login authenticator failed for ([49.124.148.201]) [49.124.148.201]:50084: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 00:50:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<JIxVMhpDethnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-09 00:51:35 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:58064: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.56.179
country_id: 6252001
description:
Nov  9 00:51:17 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.221.56.179, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<d/zOMxpDDpMU3Tiz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 00:52:13 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Bwz/NhpDJhhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 00:53:08 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rR1ROhpDEIal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 00:54:14 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<mLsyPhpDrmG2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 00:54:59 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<fhntQBpDLpOxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 00:57:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<gHRdSxpD0sRK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  9 01:01:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<H/ytVxpD4LWl0xnK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov  9 01:02:17 host2 pure-ftpd[1321498]: (?@198.235.24.41) [INFO] New connection from 198.235.24.41


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 01:02:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<wMk0WxpDKp4v7AMK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.79.53
country_id: 6252001
description:
Nov  9 01:03:37 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.56.79.53, lip=66.85.158.91, session=<kXruXxpDkJQtOE81>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 01:03:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ReEVYBpDjs1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 01:12:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=</iv0fRpDqp4v/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 01:12:26 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<Tu9MfxpDKtkr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 01:15:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<6JQIixpDuoVm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 01:15:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<niuwixpDmumxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:16:10 host2 sshd[1338212]: Disconnected from invalid user ts1 45.78.217.142 port 37228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-11-09 01:16:41 dovecot_login authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:52589: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-09 01:16:57 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:50041: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Nov  9 01:17:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.157, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<VhG+khpDsci594md>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:17:20 host2 sshd[1339881]: Disconnected from invalid user api_user 103.213.238.91 port 35082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  9 01:17:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<ETBukRpDsLWi8JQo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:17:42 host2 sshd[1340392]: Disconnected from invalid user ts1 172.245.177.148 port 50156 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.72
country_id: 2635167
description:
Nov  9 01:17:49 host2 dovecot[1078614]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.72, lip=66.85.158.91, TLS, session=<mr6vkhpDgdpX7LBI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 01:18:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<8ZVulBpD4paP9IUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.172
country_id: 2635167
description:
Nov  9 01:18:23 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.172, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Fyq5lBpD+c6594ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.157
country_id: 2635167
description:
Nov  9 01:18:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<b5a0lhpDCZxX7LCd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Nov  9 01:19:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.165, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<zwywmBpDBYe594ml>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.237.3
country_id: 1819730
description:
Nov  9 01:19:42 host2 sshd[1342794]: Disconnected from invalid user artur 47.83.237.3 port 60868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.179
country_id: 2635167
description:
Nov  9 01:20:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.179, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Nr2rmhpD4YJX7LCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 01:20:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<teSQnBpD4tRm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.150
country_id: 2635167
description:
Nov  9 01:20:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.150, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZQmlnBpD45m594mW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.171
country_id: 2635167
description:
Nov  9 01:21:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.171, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ro+doBpD0Za594mr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.176
country_id: 2635167
description:
Nov  9 01:21:09 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.176, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Dk+inhpDzc1X7LCw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.170
country_id: 2635167
description:
Nov  9 01:22:16 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.170, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<SxCXohpDv9S594mq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 01:22:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OOsTpBpDhr1nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Nov  9 01:22:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<X7mSpBpD97e594ml>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:23:51 host2 sshd[1347713]: Disconnected from invalid user celeryuser 103.213.238.91 port 38632 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 01:23:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qThLqBpDan2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 01:24:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<3PKAqhpDWsJnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:24:34 host2 sshd[1348667]: Disconnected from invalid user akshay 172.245.177.148 port 48734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Nov  9 01:25:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.92, TLS handshaking: Connection closed, session=<icqhrBpDa9fDuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Nov  9 01:25:19 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tVSErRpDbMPN0h9Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov  9 01:25:21 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9fCerRpDBgnCpRCk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Nov  9 01:25:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PZIOrhpDQaLDuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.73
country_id: 6252001
description:
Nov  9 01:25:31 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.73, lip=66.85.158.92, TLS: Connection closed, session=<xHY9rhpDm9rDuExJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:25:42 host2 sshd[1350152]: Disconnected from invalid user svn 172.245.177.148 port 49278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.154
country_id: 6252001
description:
Nov  9 01:25:15 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.154, lip=66.85.158.92, TLS: Connection closed, session=<zZ1CrRpDueDDuEya>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.177.148
country_id: 6252001
description:
Nov  9 01:26:52 host2 sshd[1351478]: Disconnected from invalid user user5 172.245.177.148 port 49830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.237.3
country_id: 1819730
description:
Nov  9 01:27:00 host2 sshd[1351637]: Disconnected from invalid user svn 47.83.237.3 port 50290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 01:27:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<T84fthpD2tlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 01:28:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<6zHeuBpD4MkrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:28:59 host2 sshd[1353904]: Disconnected from invalid user admin 103.213.238.91 port 50684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 01:29:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<YACyuhpDWI+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 01:29:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xcLNvBpDXLFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-09 01:30:47 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:52321: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Nov  9 01:30:49 host2 sshd[1356053]: Disconnected from invalid user gogs 103.4.145.50 port 42332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-09 01:30:40 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:54744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Nov  9 01:30:42 host2 sshd[1355930]: Disconnected from invalid user posiflex 103.213.238.91 port 54686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.51
country_id: 6252001
description:
Nov  9 01:31:10 host2 dovecot[1078614]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.51, lip=66.85.158.91, session=<lzZuwhpDBrqsaAsz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:31:21 host2 sshd[1356652]: Disconnected from invalid user ww 181.49.8.57 port 33190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 01:31:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ZnNwxBpDLNxm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 01:32:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<gCgwxhpD4t+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 01:32:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<e0gWxxpDWLovT1jH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:33:29 host2 sshd[1359253]: Disconnected from invalid user zammad 181.49.8.57 port 58810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 01:34:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<5dsozhpDeoRn76Vy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.94
country_id: 6252001
description:
Nov  9 01:35:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.94, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<huoC0RpDCNjN0h9e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov  9 01:36:33 host2 sshd[1362498]: Disconnected from invalid user splunk 181.49.8.57 port 40780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:36:38 host2 sshd[1362509]: Disconnected from invalid user celeryuser 45.78.217.142 port 37032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Nov  9 01:37:00 host2 sshd[1362863]: Disconnected from invalid user hadoop 103.4.145.50 port 52512 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 01:37:30 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<rOj12BpDbKVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 01:38:03 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<FTPy2hpDFInRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 01:38:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<odII3RpDfZ0vWbHj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.123
country_id: 2635167
description:
Nov  9 01:39:06 host2 dovecot[1078614]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.123, lip=66.85.158.91, TLS, session=<gs7G3hpDY95X7LB7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  9 01:39:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<zmzO4BpDJIiOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 01:39:55 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<4F6a4RpD4MRD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:40:26 host2 sshd[1366556]: Disconnected from invalid user andreas 190.156.238.162 port 57298 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 01:40:41 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<9StX5BpDCIhK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-11-09 01:41:39 dovecot_login authenticator failed for (74-95-13-185-sfba.hfc.comcastbusiness.net) [74.95.13.185]:54058: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-09 01:41:50 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:50349: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 01:42:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=</25p6xpDP74z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 01:43:47 host2 sshd[1370013]: Disconnected from invalid user teamspeak 190.156.238.162 port 44480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 01:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<tEpk8xpD7LqP9IUv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:45:26 host2 sshd[1372538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 01:47:02 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<I8kG+xpDZplD2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov  9 01:47:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<BcVG/RpDVP4t4/6Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 01:47:38 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<ugI3/RpDzKwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 01:48:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<aBLxARtDCDNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 01:51:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<P5oTCxtDGqul6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.81
country_id: 6252001
description:
Nov  9 01:51:54 host2 pure-ftpd[1379570]: (?@198.235.24.81) [INFO] New connection from 198.235.24.81


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-09 01:53:00 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:53814: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 01:52:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ZAv4DhtDAImYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-09 01:52:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:44448: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 01:53:22 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<a++xERtD+VK2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 01:53:32 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<FBJUEhtDrJIv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 01:53:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<5Xp5EhtDdtCxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 01:55:55 host2 sshd[1384367]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 01:58:42 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Ar/BJBtD6p1noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 01:59:50 host2 sshd[1388564]: Disconnected from invalid user mana 45.78.217.142 port 57762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.134
country_id: 3469034
description:
Nov  9 02:01:13 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@agentallianz.com>, method=PLAIN, rip=187.120.73.134, lip=66.85.158.91, TLS, session=<2n+2LBtDaNy7eEmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.92
country_id: 798544
description:
Nov  9 02:01:30 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.228.33.92, lip=66.85.158.91, TLS, session=<B1nvLRtDqIZb5CFc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:02:27 host2 sshd[1391993]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:05:00 host2 sshd[1395011]: Disconnected from invalid user svn 45.78.217.142 port 39694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 02:05:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<3zjvPRtDLMA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:07:46 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<w6kzRRtDyLhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.142
country_id: 1880251
description:
Nov  9 02:09:59 host2 sshd[1400515]: Disconnected from invalid user posiflex 45.78.217.142 port 50716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 02:11:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<CvSWUhtDSJtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 02:11:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QaS7UhtDMt8r4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  9 02:12:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<bb0IVRtD8qKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:14:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<J72LXRtDMNGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 02:15:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<fc36YRtDMrMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 02:15:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<FNnYYRtD0pdm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:17:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<dq72ZhtDAIaP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Nov  9 02:19:50 host2 sshd[1412316]: Disconnected from invalid user soporte 190.156.238.162 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:20:28 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<OXuhchtD3EQv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:22:06 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<RA1xeBtDNNhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 02:22:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<M6lIeRtD5M5nVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-09 02:23:09 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:52815: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-09 02:23:26 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:50666: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:24:40 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7/KmgRtDctM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:27:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<KOM6ihtDsKeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:27:51 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pfIEjRtDGOiPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:29:01 host2 sshd[1423919]: Disconnected from invalid user sbi 196.196.253.2 port 54686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 02:31:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<OFqKmBtD3OaPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:30:45 host2 sshd[1426003]: Disconnected from invalid user choi 4.213.177.240 port 57278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.2
country_id: 2635167
description:
Nov  9 02:31:32 host2 sshd[1427236]: Disconnected from invalid user tmp 196.196.253.2 port 58416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 02:31:49 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kTI8mxtDaIZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 02:33:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<DYnvoBtD+qNm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:33:43 host2 sshd[1430171]: Disconnected from invalid user deployer 4.213.177.240 port 58332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 02:34:18 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wE0RpBtD6OdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 02:34:56 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<RsFaphtDVJQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 02:35:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<o+ylphtDZBAv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 02:35:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<EeeMqBtDTpdCYSpH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.33
country_id: 1733045
description:
Nov  9 02:35:38 host2 sshd[1432620]: Disconnected from invalid user gu 202.157.177.33 port 37126 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 02:37:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<CJJnrhtDls1K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 02:37:58 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<0hg1sRtD9JRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 02:40:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Qu60uBtD9OUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 02:40:12 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<j5g1uRtDgMjRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-09 02:40:18 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:47934: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-09 02:40:30 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:58338: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 02:40:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<7DqjuhtDHsM+PIOJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 02:42:05 host2 sshd[1439758]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.177.240
country_id: 1269750
description:
Nov  9 02:41:33 host2 sshd[1439149]: Disconnected from invalid user mark 4.213.177.240 port 37616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 02:42:45 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<KhhSwhtDCqeP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 02:44:31 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yZOWyBtDLL8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:44:48 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<5dqiyRtDQqBD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 02:44:53 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<iNDzyRtDluwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 02:45:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oFnbyxtDak1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.243
country_id: 3175395
description:
Nov  9 02:46:45 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@agentallianz.com>, method=PLAIN, rip=217.26.179.243, lip=66.85.158.91, TLS, session=<X3avzxtD8rfZGrPz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.16.167
country_id: 3175395
description:
Nov  9 02:47:04 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.43.16.167, lip=66.85.158.91, TLS, session=<vTHT0BtDstm5KxCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-09 02:48:48 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:51457: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-09 02:48:56 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:51655: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-11-09 02:48:11 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (housion) [73.88.196.91]:51610: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 02:50:37 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<aFlv3htDKJGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 02:51:29 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<J7iF4RtDlLdK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 02:52:00 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<98Bn4xtDCoxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 02:52:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<CaCT5BtDuTC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 02:52:33 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<G9lW5RtDbJmxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 02:56:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<evD08RtDerOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 02:58:15 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<up25+RtD8Kov+yzS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:00:23 host2 sshd[1461946]: Disconnected from invalid user eun 201.76.120.30 port 37324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:02:05 host2 sshd[1463679]: Disconnected from invalid user redhat 201.76.120.30 port 41600 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  9 03:02:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<727qBxxDgoNChJmC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Nov  9 03:03:49 host2 sshd[1466682]: Disconnected from invalid user wangxin 201.76.120.30 port 45876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.71.21
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.71.21, lip=66.85.158.92, session=<xm7IDxxDgWmhI0cV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.214.41
country_id: 2921044
description:
Nov  9 03:04:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.90.214.41, lip=66.85.158.92, session=<F9zODxxD1LekWtYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:07:20 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4CBCGhxDmKVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  9 03:08:04 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<jdXTHBxDaJqi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 03:11:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<MCpMKhxD7Okr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-09 03:13:45 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:53574: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:13:47 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<D61SMRxDfNyxiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-09 03:13:54 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:60878: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:13:54 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<rZa0MRxDCuaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 03:16:24 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<6iemOhxD2qlm1PbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.153.115.3
country_id: 2921044
description:
2025-11-09 03:16:31 dovecot_login authenticator failed for ([148.153.115.3]) [148.153.115.3]:35794: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-09 03:16:51 dovecot_login authenticator failed for ([125.19.169.115]) [128.185.235.110]:36872: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov  9 03:17:28 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, session=<37qbPhxDSOjG6xhS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-09 03:17:59 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:46403: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 03:18:11 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<UvIGQRxDKpFK4fqm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-09 03:18:18 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:11253: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:19:55 host2 sshd[1486400]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 03:20:07 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<SZ7yRxxDuqMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 03:20:25 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<cLwBSRxDiMtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 03:20:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<ZbqlSRxDNqpnVK2y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-09 03:20:58 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:50654: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-11-09 03:22:21 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:44743: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:23:35 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<pblSVBxDVuxm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.205.93
country_id: 1880251
description:
Nov  9 03:23:49 host2 sshd[1491328]: Disconnected from invalid user rocketmq 45.78.205.93 port 34320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Nov  9 03:24:23 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, TLS: Connection closed, session=<mC1TVxxD/75bxJiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.166
country_id: 3017382
description:
Nov  9 03:24:39 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.166, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xOdIWBxD89JbxJim>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Nov  9 03:24:11 host2 dovecot[1078614]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iHahVhxD+aZbxJiR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:26:34 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<R0AHXxxDfoKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:27:44 host2 sshd[1496251]: Disconnected from invalid user user 101.47.48.65 port 57306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  9 03:29:44 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<IUJcahxDzriPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 03:30:24 host2 sshd[1499618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 03:33:50 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<upcHeRxDnNOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 03:34:43 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<BO0qfBxDcqZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  9 03:37:36 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<vOh2hhxDQLxK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 03:38:01 host2 dovecot[1078614]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<Fmb2hxxDdqVn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  9 03:39:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<H5XRixxD2KuP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 03:40:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<GdjujxxDoLlA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 03:41:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6pJ7lBxDRqdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  9 03:41:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mk//lBxDZjQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 03:42:52 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Q7hGmRxDdrDRJvZG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:42:13 host2 sshd[1513251]: Disconnected from invalid user erpnext 43.173.120.212 port 37110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<64sPmBxD5oUrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 03:42:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<V5sImBxD2sArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 03:42:49 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<n+0imRxDNyFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:44:00 host2 sshd[1515171]: Disconnected from invalid user bill 43.173.120.212 port 43570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 03:44:35 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<At9vnxxDbL1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  9 03:46:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<2pSKpBxD6KU+PIOL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.199.63.109
country_id: 2802361
description:
Nov  9 03:46:10 host2 pure-ftpd[1519066]: (?@104.199.63.109) [INFO] New connection from 104.199.63.109


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:46:27 host2 sshd[1519448]: Disconnected from invalid user oem 43.173.120.212 port 46374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  9 03:46:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<BmM3phxDvcAz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.120.212
country_id: 6252001
description:
Nov  9 03:47:38 host2 sshd[1521783]: Disconnected from invalid user ca 43.173.120.212 port 47776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  9 03:48:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<u0UKrBxDTMSOtOyP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 03:49:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=</FFurxxD2OQvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:48:11 host2 sshd[1522451]: Disconnected from invalid user vision 101.36.124.127 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:50:07 host2 sshd[1524712]: Disconnected from invalid user manager 101.36.108.134 port 55000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 03:50:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+8SxsxxD0oql6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 03:50:17 host2 sshd[1524998]: Disconnected from invalid user toby 101.47.48.65 port 58296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:50:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<zI/5sxxD0I5D2fSf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov  9 03:50:41 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1A1ntRxDMqNChJly>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:51:22 host2 sshd[1526466]: Disconnected from invalid user www 101.36.108.134 port 60238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  9 03:51:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<1/WZuBxDoXa2uHYF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:52:15 host2 sshd[1527620]: Disconnected from invalid user zookeeper 151.49.129.67 port 34890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 03:52:37 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<XVYwvBxD4taxiOOT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 03:52:37 host2 sshd[1528242]: Disconnected from invalid user ca 101.36.108.134 port 41654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 03:53:35 host2 sshd[1529366]: Disconnected from invalid user cyl 151.49.129.67 port 55816 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 03:54:57 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jlOrxBxD/i+hI8Fx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.29.39
country_id: 2921044
description:
Nov  9 03:54:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.29.39, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<roCQwhxDn1Gd5h0n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:55:24 host2 sshd[1532185]: Disconnected from invalid user ec2-user 101.36.124.127 port 52544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 03:56:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<Rf9QyBxDOMQv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov  9 03:56:35 host2 sshd[1533444]: Disconnected from invalid user moshe 101.36.124.127 port 43708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  9 03:56:22 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<43iYyRxDkuA+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 03:57:36 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<Jiz9zRxDpKJD2fSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Nov  9 04:00:43 host2 sshd[1538374]: Disconnected from invalid user pos 151.49.129.67 port 57354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:00:22 host2 sshd[1538071]: Disconnected from invalid user office 101.36.108.134 port 56114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov  9 04:01:44 host2 sshd[1539358]: Disconnected from invalid user bill 101.36.108.134 port 54868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.43
country_id: 798544
description:
Nov  9 04:01:50 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@agentallianz.com>, method=PLAIN, rip=178.216.29.43, lip=66.85.158.91, TLS, session=<7YJG3BxDocyy2B0r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:01:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<dwCz2xxDSI9K4fqm>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.54.213.197
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.54.213.197: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-09 04:02:45 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (daling) [73.145.107.251]:46286: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 167.179.44.27
country_id: 1831722
description:
2025-11-09 04:02:53 H=(87.117.231.66) [167.179.44.27]:59077 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <orange@imobust.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.103.58
country_id: 798544
description:
Nov  9 04:02:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.150.103.58, lip=66.85.158.91, TLS, session=<XRpV3RxDnLjClmc6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 04:03:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<SJHh4xxDRpsv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:04:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<JVVC5xxDPOCYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:08:37 host2 sshd[1547697]: Disconnected from invalid user vivek 185.217.131.127 port 38134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.167.33
country_id: 6252001
description:
Nov  9 04:11:35 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.167.33, lip=66.85.158.91, session=<ziomAB1D2ooUU6ch>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:11:19 host2 sshd[1551511]: Disconnected from invalid user public 185.217.131.127 port 58356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 04:11:21 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<zLYy/xxDkpMv7AMK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:12:37 host2 sshd[1553688]: Disconnected from invalid user ice 185.217.131.127 port 57644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 04:12:43 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<QKsLBB1DTIor4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.65
country_id: 1880251
description:
Nov  9 04:12:55 host2 sshd[1554075]: Disconnected from invalid user rtorrent 101.47.48.65 port 38496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:14:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<atMpCh1Dfr6xiOOT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-09 04:15:37 dovecot_plain authenticator failed for (unbeety) [38.148.95.217]:39219: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:17:44 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Pi0GFh1DbJRnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:18:40 host2 sshd[1561206]: Disconnected from invalid user mahmoud 45.78.216.136 port 60924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.217.131.127
country_id: 1512440
description:
Nov  9 04:18:55 host2 sshd[1561514]: Disconnected from invalid user dolphinscheduler 185.217.131.127 port 34582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  9 04:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<RUBuFx1D8Ltm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 04:19:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<lspgGx1DOLVnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:19:53 host2 sshd[1562666]: Disconnected from invalid user marketing 103.210.22.17 port 58544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:20:45 host2 sshd[1563901]: Disconnected from invalid user couchdb 45.78.218.119 port 49628 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.174
country_id: 6252001
description:
Nov  9 04:22:57 host2 pure-ftpd[1566544]: (?@135.237.125.174) [INFO] New connection from 135.237.125.174


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:22:46 host2 sshd[1566308]: Disconnected from invalid user tobi 103.210.22.17 port 59644 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:24:12 host2 sshd[1568501]: Disconnected from invalid user dong 103.210.22.17 port 56586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 04:25:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<xlaVMB1D7ukv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:25:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<C1YmMR1DEOxm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Nov  9 04:25:37 host2 sshd[1570914]: Disconnected from invalid user precious 103.210.22.17 port 56990 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.214.122.74
country_id: 357994
description:
Nov  9 04:27:23 host2 pure-ftpd[1573463]: (?@188.214.122.74) [INFO] New connection from 188.214.122.74


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.13
country_id: 1227603
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.40.13, lip=66.85.158.91, TLS, session=<LcXQOB1D4NBinygN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.12
country_id: 130758
description:
Nov  9 04:27:27 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=62.133.46.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<C/jjOB1DVOI+hS4M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.135
country_id: 1643084
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.135, lip=66.85.158.91, session=<gZLLOB1DjMOt78mH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.151
country_id: 1522867
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=62.133.47.151, lip=66.85.158.91, session=<jS/IOB1D6Ik+hS+X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.238
country_id: 3144096
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.97.238, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I5DPOB1DIu25/WHu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.140
country_id: 1814991
description:
Nov  9 04:27:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.140, lip=66.85.158.91, session=<C7DMOB1DoT688VCM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.139
country_id: 783754
description:
Nov  9 04:27:26 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.139, lip=66.85.158.91, session=<etnPOB1D2qYfq5iL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 04:28:19 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<sWzTOx1DNJhK4fqm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.41
country_id: 6252001
description:
Nov  9 04:29:10 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.41, lip=66.85.158.92, session=<UdT/Ph1Dxr+synYp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 04:31:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<8WUSRh1DqsxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:31:46 host2 sshd[1580458]: Disconnected from invalid user lcx 45.78.216.136 port 38882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-09 04:35:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unmorang) [87.103.126.54]:44654: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-11-09 04:35:43 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (mings) [71.229.43.123]:34910: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.216.136
country_id: 1880251
description:
Nov  9 04:36:51 host2 sshd[1588309]: Disconnected from invalid user public 45.78.216.136 port 56718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-09 04:36:11 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56994: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 04:36:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<KRovWR1D4Otm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:37:14 host2 sshd[1588925]: Disconnected from invalid user gabriele 45.78.218.119 port 54940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.107.25
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.107.25, lip=66.85.158.91, session=<Jd5+Wx1Dh32d5msZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.193.113
country_id: 2921044
description:
Nov  9 04:37:08 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.193.113, lip=66.85.158.91, session=<U9CEWx1D7jqhI8Fx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:37:11 host2 sshd[1588808]: Disconnected from invalid user arkserver 101.47.142.27 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.27
country_id: 1880251
description:
Nov  9 04:39:51 host2 sshd[1592127]: Disconnected from invalid user bitrix 101.47.142.27 port 42562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  9 04:40:16 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<gVCZZh1DpIgrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  9 04:41:20 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<rpphah1DWh1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 04:42:01 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<q3DRbB1D+rVn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-11-09 04:42:14 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:59362: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-09 04:42:24 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:49446: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 04:42:38 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7yELbx1DsCmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  9 04:46:05 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<r+Vjex1DQqjRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 04:46:50 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<o+0Xfh1DmtRA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.119
country_id: 1880251
description:
Nov  9 04:50:38 host2 sshd[1606937]: Disconnected from invalid user wjx 45.78.218.119 port 51600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<UWDnjB1DirKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  9 04:50:59 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<HLbmjB1DJI8rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:51:58 host2 sshd[1608762]: Disconnected from invalid user user 2.57.121.25 port 27404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  9 04:52:12 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Pio9kR1DSL5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 04:53:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<fUNwlR1DOoaxiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 04:54:17 host2 sshd[1614095]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  9 04:54:18 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Vg7AmB1D0pZCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 04:56:26 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<YOhloB1DuOxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  9 04:58:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6e2Epx1DvtkvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  9 04:59:27 host2 sshd[1621275]: Disconnected from invalid user user 2.57.121.25 port 25625 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.160
country_id: 3469034
description:
Nov  9 05:00:24 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@agentallianz.com>, method=PLAIN, rip=177.44.96.160, lip=66.85.158.91, TLS, session=<zVKrrR1DBKyxLGCg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.184.91
country_id: 3865483
description:
Nov  9 05:00:45 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.0.184.91, lip=66.85.158.91, TLS, session=<mpzZrh1D1dOKALhb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-09 05:02:55 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:57259: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-09 05:03:26 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:42796: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  9 05:03:47 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<flqvuh1DfIBD2fSf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  9 05:04:45 host2 sshd[1627153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  9 05:09:29 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<RyEOzx1DAokv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:11:40 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<64fe1h1DbKhK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:13:02 host2 sshd[1636338]: Disconnected from invalid user laci 200.44.190.194 port 47190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:12:10 host2 sshd[1635433]: Disconnected from invalid user min 102.210.148.92 port 34030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:12:32 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<jNv+2R1D6jWYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-09 05:14:27 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:60124: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-09 05:14:35 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:54204: 535 Incorrect authentication data (set_id=charanaw)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:15:06 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<aMIl4x1DfKGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  9 05:14:15 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<vJIW4B1D3s8r4TT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  9 05:16:46 host2 sshd[1640687]: Disconnected from invalid user devuser 200.44.190.194 port 47942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.148.92
country_id: 953987
description:
Nov  9 05:18:16 host2 sshd[1642266]: Disconnected from invalid user sshuser 102.210.148.92 port 37066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  9 05:18:08 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<uq367R1DELJnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:21:33 host2 sshd[1645746]: Disconnected from invalid user dave 86.107.77.118 port 46912 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  9 05:24:17 host2 dovecot[1509044]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, TLS, session=<51klBB5DQNCUcd3D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:25:27 host2 sshd[1649880]: Disconnected from invalid user ken 43.135.75.196 port 46974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-09 05:25:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (pication) [71.62.34.216]:47668: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:27:04 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6tv6DR5DiItnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:27:31 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<ttGKDx5DvD0v7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:28:06 host2 sshd[1652608]: Disconnected from invalid user localhost 43.135.75.196 port 51802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:27:07 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<c9obDh5DfORm1bVi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.118
country_id: 2921044
description:
Nov  9 05:27:08 host2 sshd[1651658]: Disconnected from invalid user ftpuser 86.107.77.118 port 47382 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-09 05:28:35 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:28444: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:29:24 host2 sshd[1654566]: Disconnected from invalid user support 43.135.75.196 port 54194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.135.75.196
country_id: 1819730
description:
Nov  9 05:32:00 host2 sshd[1657587]: Disconnected from invalid user orca 43.135.75.196 port 59048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  9 05:31:23 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<VX1bHR5DFuYv/WCP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-11-09 05:34:02 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:50096: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-09 05:34:27 dovecot_login authenticator failed for ([216.194.174.80]) [216.194.174.27]:21251: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Nov  9 05:36:42 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.224, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mZeCMB5D48TN0h/g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  9 05:38:14 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<qEPgNR5DJqZK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  9 05:38:25 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<0TmJNh5D3M9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  9 05:40:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<9nLJPB5Dsu1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  9 05:41:17 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<i9enQB5DgAcv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  9 05:46:28 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<BP9OUx5DaMZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  9 05:50:03 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<8mskYB5DBFaYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:58 host2 pure-ftpd[1679986]: (?@195.178.110.160) [INFO] New connection from 195.178.110.160


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:50:59 host2 dovecot[1509044]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, session=<HfidYx5DuIHDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  9 05:52:00 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<7TgnZx5DyL+l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.160
country_id: 732800
description:
Nov  9 05:51:10 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.160, lip=66.85.158.92, TLS, session=<TfNHZB5DdobDsm6g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  9 05:54:34 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<u/NHcB5DNuexiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  9 05:54:58 host2 dovecot[1509044]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<L7a3cR5DWp1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-11-09 05:55:28 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:47834: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


