# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 22:35:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<5ZG/DkZETI0+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 22:35:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<rScyD0ZEXJo+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 22:36:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<aSBzEkZE0uUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 22:36:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<GqRSEUZEipQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 22:36:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9EJfEUZEgOtn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 22:37:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rteLE0ZEwJLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 22:37:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<HUJ6FkZEALov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 22:39:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<n7duGkZEqqQEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 22:39:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<xowmHUZEuM4I04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-23 22:39:41 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (scheopperd) [98.204.134.124]:52232: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 22:40:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<1rf8HkZENN8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 22:41:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2zoRI0ZE+OGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 22:42:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<XHK6JUZEnsQ+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 22:44:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rglgLEZE5uQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-11-23 22:46:06 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:36948: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-23 22:47:12 dovecot_plain authenticator failed for (snephtil) [64.72.74.162]:34909: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 22:48:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8OpsOkZEHsMrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 22:49:10 host2 sshd[607123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 22:49:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<l6Z2QUZERutA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 22:50:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jIsNQ0ZEdP0vTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 22:51:14 host2 sshd[609376]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 22:52:57 host2 sshd[611152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 22:52:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<AMQnSUZE4tw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 22:53:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<mdHCT0ZEsLE+PIcs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 22:54:41 host2 sshd[613778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 22:54:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<F0sRUUZEos4+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 22:55:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<5mylU0ZEk0Rniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 22:56:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<UA4pV0ZE1rd2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 23 22:55:16 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.91, session=<8/x8VEZEcKmUcdOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 22:55:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MwE4VUZECNSPbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 22:56:27 host2 sshd[615609]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.78.26
country_id: 6252001
description:
Nov 23 22:56:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.78.26, lip=66.85.158.92, session=<ZN2YWUZErqEUDk4a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 22:58:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<G7lJYEZElo2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 22:58:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tRC1YUZEyM4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 22:59:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<CbeMZEZE0NE+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-23 23:00:41 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57276: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 23:00:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<g31saEZEOMwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 23:00:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZiHCaEZEduBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 23:02:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<CBSGbEZE0oTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 23:01:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ia9saUZEzu2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-23 23:01:09 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45716: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.93.239
country_id: 6252001
description:
Nov 23 23:02:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.93.239, lip=66.85.158.91, session=<jvoFb0ZEroMUDl3v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 23:03:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<efNscEZEOqAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 23:02:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<5ma5bkZEpIIv+yXY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.206
country_id: 6252001
description:
Nov 23 23:03:10 host2 pure-ftpd[621796]: (?@198.235.24.206) [INFO] New connection from 198.235.24.206


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 23:03:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<OhVmcUZEQsUEkXBg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.179.196.239
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.179.196.239 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.170
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.237.121.170 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.199.225.215
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.199.225.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.175.204.106
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.175.204.106 - colourmarklabelscom "GET /login/?login_only=1&user=colourmarklabelscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabelscom (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.137.136
country_id: 6252001
description:
Nov 23 23:04:17 host2 pure-ftpd[623008]: (?@209.38.137.136) [INFO] New connection from 209.38.137.136


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.59.179.162
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.59.179.162 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.122.190.203
country_id: 1024031
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.122.190.203 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.189.216.7
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.189.216.7 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.65.149.141
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 196.65.149.141 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.179.126.73
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.179.126.73 - colourmarkla "GET /login/?login_only=1&user=colourmarkla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.19.181
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.22.19.181 - colourmark "GET /login/?login_only=1&user=colourmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmark (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.150.94.78
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.150.94.78 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.193.66.159
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.193.66.159 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.115.65.69
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.115.65.69 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.91.134.45
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 90.91.134.45 - colourmarklabe "GET /login/?login_only=1&user=colourmarklabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.150.199
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.253.150.199 - colourmarklab "GET /login/?login_only=1&user=colourmarklab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.237.139
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.128.237.139 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.18.249.147
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.18.249.147 - colourmarklabel "GET /login/?login_only=1&user=colourmarklabel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.0.121.217
country_id: 3508796
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 148.0.121.217 - colourmar "GET /login/?login_only=1&user=colourmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.70.163.160
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.70.163.160 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 23:05:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<wg1LeUZE4Kw+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.195.234.45
country_id: 1835841
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 175.195.234.45 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 23:05:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<ByGeekZEAuHF8xBa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.252.231.179
country_id: 3508796
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.252.231.179 - colourmarkl "GET /login/?login_only=1&user=colourmarkl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 23:07:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<A3htfkZEDOCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 23:07:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<mNbxfkZEyLwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 23:08:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<lrOXgkZEkpA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 23:08:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FCRug0ZE0s4v+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 23 23:12:35 host2 sshd[630857]: Disconnected from invalid user user 2.57.121.25 port 8598 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.155.107
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.43.155.107 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 23:13:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Ne5BlEZEQOsrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 23 23:13:11 host2 sshd[631195]: Disconnected from invalid user dev 50.84.211.204 port 52008 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.60.223.35
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.60.223.35 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 23:14:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<oOqumEZEetFA44h6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.175.207.187
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.175.207.187 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 23:14:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<dRgsmUZEvjUvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 23 23:14:16 host2 sshd[631752]: Disconnected from invalid user sangoma 50.84.211.204 port 50728 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.205.135
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.205.135 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 23:15:27 host2 sshd[632658]: Disconnected from invalid user katy 62.60.131.157 port 47666 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 23 23:15:21 host2 sshd[632617]: Disconnected from invalid user t 50.84.211.204 port 49446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 23:16:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pDT3oUZEDkxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 23 23:17:33 host2 sshd[633880]: Disconnected from invalid user energy 50.84.211.204 port 46876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Nov 23 23:18:50 host2 sshd[634681]: Disconnected from invalid user username 81.234.146.158 port 38844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-23 23:19:06 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:59964: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 23:18:14 host2 sshd[634286]: Disconnected from invalid user admin 2.57.121.112 port 40595 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.224.249
country_id: 290557
description:
2025-11-23 23:18:23 dovecot_login authenticator failed for ([5.30.224.249]) [5.30.224.249]:48446: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 23:19:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<4HuGqkZEEt0+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 23:20:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<utBTrkZEGq6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 23:21:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QEqpskZErpt2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Nov 23 23:21:44 host2 sshd[636706]: Disconnected from invalid user ben 81.234.146.158 port 35639 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 23 23:22:02 host2 sshd[636889]: Disconnected from invalid user dev 20.88.55.220 port 47006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.50.117.23
country_id: 6251999
description:
Nov 23 23:22:16 host2 sshd[637031]: Disconnected from invalid user whmcs 198.50.117.23 port 55210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.234.146.158
country_id: 2661886
description:
Nov 23 23:22:59 host2 sshd[637433]: Disconnected from invalid user whmcs 81.234.146.158 port 50968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 23:23:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<gVIMuUZErrcv7PP+>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 23 23:23:32 host2 sshd[637757]: Disconnecting authenticating user root 62.220.163.89 port 40146: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.220.163.89
country_id: 2661886
description:
Nov 23 23:23:32 host2 sshd[637757]: error: maximum authentication attempts exceeded for root from 62.220.163.89 port 40146 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 23 23:24:26 host2 sshd[638417]: Disconnected from invalid user daniel 20.88.55.220 port 47258 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 23:24:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=</WhSvUZEBuk+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.50.117.23
country_id: 6251999
description:
Nov 23 23:24:42 host2 sshd[638665]: Disconnected from invalid user steam 198.50.117.23 port 60408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.216.105
country_id: 6251999
description:
Nov 23 23:25:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.216.105, lip=66.85.158.91, session=<H8PnvkZEsrCUcdhp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 23:25:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<PU6uv0ZEVqYv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Nov 23 23:25:26 host2 sshd[639464]: Disconnected from invalid user user1 81.234.146.158 port 53389 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 23 23:25:37 host2 sshd[639604]: Disconnected from invalid user polls 20.88.55.220 port 47380 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 23 23:26:49 host2 sshd[640500]: Disconnected from invalid user sina 20.88.55.220 port 47500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.50.117.23
country_id: 6251999
description:
Nov 23 23:26:55 host2 sshd[640562]: Disconnected from invalid user xr 198.50.117.23 port 40394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 23:26:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kEwUw0ZEmMxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 23:26:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<CqfgxEZEyuLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 23:27:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<1pWyxkZEHpUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 23:27:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<yigCyEZE1t4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 23:27:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<CeN+yEZETIcEkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-23 23:29:01 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (kieraling) [73.195.211.98]:51970: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 23:29:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nmc9zUZEDKul6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Nov 23 23:29:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, session=<KXEFz0ZEGJdKUi8E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 23:30:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<guMo0UZEFKk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 23:30:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<15wH1EZE0umWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.82
country_id: 3175395
description:
Nov 23 23:31:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=217.26.178.82, lip=66.85.158.91, TLS, session=<UPGR1kZEEtvZGrJS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Nov 23 23:31:53 host2 sshd[644509]: Disconnected from invalid user ubuntu 20.88.55.220 port 47980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 23:31:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<B1ye10ZEqrgv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.122
country_id: 226074
description:
Nov 23 23:32:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=196.0.10.122, lip=66.85.158.91, TLS, session=<YKf410ZEwZbEAAp6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 23:32:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<9ldi2EZEVNyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 23:33:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<MzF83EZEsqcI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 23:38:00 host2 sshd[649559]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 23:37:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<uW9Z60ZENqMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 23:38:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<OrKR7UZENtcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 23:38:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<6EN970ZE7ORA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 23:38:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6LDK70ZEhAlniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 23 23:40:35 host2 sshd[652881]: Disconnected from invalid user eliot 165.154.170.25 port 59356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.215.65
country_id: 1880251
description:
Nov 23 23:40:42 host2 sshd[653021]: Disconnected from invalid user abdul 143.198.215.65 port 53844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 23:41:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<kypt+0ZEXOc+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 23 23:42:17 host2 sshd[654932]: Disconnected from invalid user prachi 165.154.170.25 port 35642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.180.33
country_id: 6252001
description:
Nov 23 23:43:14 host2 sshd[655946]: Disconnected from invalid user crystal 192.227.180.33 port 32780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.215.65
country_id: 1880251
description:
Nov 23 23:43:43 host2 sshd[656455]: Disconnected from invalid user botuser 143.198.215.65 port 39748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.202
country_id: 6252001
description:
Nov 23 23:43:52 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.202, lip=66.85.158.91, session=<XSRLAkdEcums7OTK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.88.205
country_id: 6252001
description:
Nov 23 23:44:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.88.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<G7FnBEdEJKcUDljN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 23:45:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<tY8XB0dEsp2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.180.33
country_id: 6252001
description:
Nov 23 23:45:40 host2 sshd[658447]: Disconnected from invalid user veera 192.227.180.33 port 36308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 23:46:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zZrMCkdEasJ2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.180.33
country_id: 6252001
description:
Nov 23 23:46:40 host2 sshd[659080]: Disconnected from invalid user r 192.227.180.33 port 34508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 23:46:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<53kTDUdEyqAv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 23 23:47:16 host2 sshd[659411]: Disconnected from invalid user user 2.57.121.25 port 5769 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.227.180.33
country_id: 6252001
description:
Nov 23 23:47:41 host2 sshd[659676]: Disconnected from invalid user myftp 192.227.180.33 port 37872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 23:49:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<g2n6FEdE4oIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 23:49:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<x4fPF0dEZqpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 23:50:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ElK+GUdEAMU+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 23:50:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<mpTmGkdExpTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 23:50:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<GD95G0dEiKUv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Nov 23 23:50:23 host2 sshd[661739]: Disconnected from invalid user john 165.154.105.128 port 43246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 23:51:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<FB5qHUdEqMAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 23:52:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<1IW3IEdEzMwv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-11-23 23:52:54 dovecot_login authenticator failed for ([115.248.4.85]) [115.248.4.85]:55533: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-23 23:53:02 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:49341: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.215.65
country_id: 1880251
description:
Nov 23 23:52:18 host2 sshd[663535]: Disconnected from invalid user eliot 143.198.215.65 port 55378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 23 23:53:12 host2 sshd[664452]: Disconnected from invalid user crystal 165.154.170.25 port 39646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.33.240
country_id: 6252001
description:
Nov 23 23:53:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.38.33.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<kFkzJUdEPt4UJiHw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.158.177
country_id: 3469034
description:
2025-11-23 23:54:55 dovecot_login authenticator failed for ([191.59.158.177]) [191.59.158.177]:57930: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.235
country_id: 732800
description:
Nov 23 23:55:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.253.159.235, lip=66.85.158.91, TLS, session=<qBJ5LEdEl5G5/Z/r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 23:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ht+JLUdENro+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-23 23:55:25 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:42953: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 23:55:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1KasK0dEhqIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.108.86
country_id: 3865483
description:
Nov 23 23:55:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=190.181.108.86, lip=66.85.158.91, TLS, session=<lRU1K0dEhYG+tWxW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 23:56:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<NDPxL0dEqNaYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.215.65
country_id: 1880251
description:
Nov 23 23:58:14 host2 sshd[670574]: Disconnected from invalid user prachi 143.198.215.65 port 46182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Nov 23 23:58:24 host2 sshd[670744]: Disconnected from invalid user admin 165.154.105.128 port 35134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 23:59:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<r/leOEdEpM6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 23:59:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ax87OkdEDpUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 00:00:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<CznYPEdEgoGWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 00:00:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<fQ/LPUdE3w5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 00:01:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<iJvYP0dEiNwvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 24 00:00:14 host2 sshd[673640]: Disconnected from invalid user test 165.154.170.25 port 44726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 00:01:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<PgW2QkdEhskrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 00:01:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uXEbQUdERqlA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 24 00:01:39 host2 sshd[675400]: Disconnected from invalid user mukul 165.154.170.25 port 47158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 24 00:04:25 host2 sshd[678936]: Disconnected from invalid user deployer 165.154.170.25 port 55250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.170.25
country_id: 1605651
description:
Nov 24 00:05:43 host2 sshd[680452]: Disconnected from invalid user spooler 165.154.170.25 port 34352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Nov 24 00:06:29 host2 sshd[681261]: Disconnected from invalid user test 165.154.105.128 port 55268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 00:10:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<RP9GYUdEYoov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 00:10:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<GLCmYkdEPrl2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 00:10:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<119UYEdEFOWPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.235
country_id: 6252001
description:
Nov 24 00:10:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZTqcYEdETNrG6xjr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 00:11:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<16zYZEdEAoYv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Nov 24 00:11:50 host2 sshd[687453]: Disconnected from invalid user ikeda 45.78.220.10 port 53732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 00:13:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<dWW6bUdEboQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 00:14:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OOyEb0dEINxn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 24 00:14:35 host2 sshd[690189]: Disconnected from invalid user sfserver 103.14.33.177 port 45520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 00:15:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ssHMcUdE8uEEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Nov 24 00:15:16 host2 sshd[690825]: Disconnected from invalid user sfserver 103.139.192.90 port 35304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 24 00:15:55 host2 sshd[691327]: Disconnected from invalid user anti 103.14.33.177 port 59994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 24 00:16:00 host2 sshd[691380]: Disconnected from invalid user user 91.240.15.18 port 59562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 00:16:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<zNXXdUdEfKjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 00:16:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<mWgNdkdE8r4+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.167.221
country_id: 1880251
description:
Nov 24 00:16:29 host2 sshd[691795]: Disconnected from invalid user ansible 43.134.167.221 port 58092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 00:17:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Q6f4eEdEmrov+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 24 00:17:14 host2 sshd[692347]: Disconnected from invalid user test036 91.240.15.18 port 52266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Nov 24 00:16:21 host2 sshd[690822]: Disconnected from invalid user p 45.78.220.10 port 36384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.167.221
country_id: 1880251
description:
Nov 24 00:17:46 host2 sshd[692743]: Disconnected from invalid user bhanu 43.134.167.221 port 49014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 00:18:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<RcKPf0dESowv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.167.221
country_id: 1880251
description:
Nov 24 00:19:02 host2 sshd[693679]: Disconnected from invalid user p 43.134.167.221 port 44028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 24 00:19:36 host2 sshd[694160]: Disconnected from invalid user ali 91.240.15.18 port 35344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 00:19:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<UdyggkdESK3F8xBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 24 00:20:16 host2 sshd[695087]: Disconnected from invalid user carla 206.217.136.36 port 49396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.98.153
country_id: 1880251
description:
Nov 24 00:19:27 host2 sshd[694025]: Disconnected from invalid user ahmed 43.128.98.153 port 36872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.98.153
country_id: 1880251
description:
Nov 24 00:22:14 host2 sshd[696459]: Disconnected from invalid user samuel 43.128.98.153 port 53462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 00:21:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2v9QiEdEJNGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 00:21:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<D6Q3iEdEeIE+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 24 00:21:26 host2 sshd[695967]: Disconnected from invalid user edu 206.217.136.36 port 37206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.240.15.18
country_id: 1512440
description:
Nov 24 00:22:02 host2 sshd[696309]: Disconnected from invalid user anti 91.240.15.18 port 44866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 00:22:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<zEO4i0dEwMA+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 00:22:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<CWFcjEdE4BVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 24 00:22:31 host2 sshd[696701]: Disconnected from invalid user syncthing 206.217.136.36 port 49046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Nov 24 00:23:04 host2 sshd[697112]: Disconnected from invalid user librenms 103.139.192.90 port 34432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 00:23:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<N5lvkUdEfHwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 00:24:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<PIVLkkdE+o9A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 24 00:23:33 host2 sshd[697420]: Disconnected from invalid user dev 206.217.136.36 port 48788 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 00:24:20 host2 sshd[697946]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.136.36
country_id: 6252001
description:
Nov 24 00:24:32 host2 sshd[698101]: Disconnected from invalid user admin 206.217.136.36 port 37614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.98.153
country_id: 1880251
description:
Nov 24 00:24:47 host2 sshd[698254]: Disconnected from invalid user syncthing 43.128.98.153 port 55920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 24 00:25:28 host2 sshd[698902]: Disconnected from invalid user ikeda 103.14.33.177 port 34822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 00:25:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<fqe1mEdEBoMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 00:26:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nM8em0dELoIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.79
country_id: 690791
description:
Nov 24 00:28:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.79, lip=66.85.158.91, TLS, session=<xhwqoEdEI4fCLIxP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.68
country_id: 953987
description:
Nov 24 00:27:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.42.68, lip=66.85.158.91, TLS, session=<J0LVnkdEX9xmQCpE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 00:28:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<IOLtoUdESrKl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Nov 24 00:28:29 host2 sshd[700440]: Disconnected from invalid user system 165.154.105.128 port 32986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 00:29:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<M0RDpUdEBMuWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.10
country_id: 1880251
description:
Nov 24 00:30:09 host2 sshd[701396]: Disconnected from invalid user brandon 45.78.220.10 port 58650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 00:31:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<swYSrkdEYJI+PIcg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.147.216.226
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 197.147.216.226 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.124.251.225
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.124.251.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.146.174.229
country_id: 272103
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 82.146.174.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.225.87.9
country_id: 719819
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 84.225.87.9 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.78.226.222
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 27.78.226.222 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.252.157.36
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.252.157.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 00:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<8mUOtUdEUrUv+3xn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.239.87.154
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.239.87.154 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 00:34:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Zgu7tkdE/uAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 00:35:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<6+/JuUdEBpOPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2025-11-24 00:36:11 dovecot_login authenticator failed for ([49.124.142.135]) [49.124.142.135]:39596: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 00:36:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<XbOavUdEQs4+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 00:35:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<dPnEu0dEcqN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 00:36:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<vECGv0dEqOov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 00:38:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Hhx3xkdEQNVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 00:39:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<I98byEdEjoEEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Nov 24 00:40:29 host2 sshd[708092]: Disconnected from invalid user dockeradmin 165.154.105.128 port 49054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 00:42:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<iE0m0kdEhqgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 00:42:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<T1O600dEkOTIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 24 00:42:26 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=<iifG00dE8JKUcdOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 00:42:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gZIN1EdEZOQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 00:44:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<SH+420dEvRtniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.220.10
country_id: 1880251
description:
Nov 24 00:44:44 host2 sshd[710629]: Disconnected from invalid user ec2-user 45.78.220.10 port 54328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 00:45:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2bZP4EdEZBovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 00:46:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hk7r4kdEZs+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 00:47:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</Vtg5EdEapZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 00:50:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<A+j88EdEMNc+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 00:51:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<kyU69UdEYqsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 00:52:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<8Whe90dE6N0I04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.170.172.223
country_id: 2510769
description:
Nov 24 00:52:38 host2 sshd[716332]: Disconnected from invalid user kiosk 195.170.172.223 port 33666 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Nov 24 00:56:12 host2 sshd[719364]: Disconnected from invalid user deploy 45.81.23.49 port 43008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.170.172.223
country_id: 2510769
description:
Nov 24 00:55:19 host2 sshd[718771]: Disconnected from invalid user bot 195.170.172.223 port 51960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 00:56:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<6U9RBkhEFtUv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Nov 24 00:57:12 host2 sshd[720094]: Disconnected from invalid user opc 45.81.23.49 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.170.172.223
country_id: 2510769
description:
Nov 24 00:56:24 host2 sshd[719472]: Disconnected from invalid user free 195.170.172.223 port 50682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 00:57:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<gFHCCkhE4Kyl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Nov 24 00:58:14 host2 sshd[720669]: Disconnected from invalid user vpnuser 45.81.23.49 port 52748 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 00:58:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<0MltDUhEDMov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 00:58:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+ALpDUhEbsCWXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.170.172.223
country_id: 2510769
description:
Nov 24 00:58:31 host2 sshd[720819]: Disconnected from invalid user kingbase 195.170.172.223 port 52876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 00:59:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ZP1nEEhEIIgv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.222.220
country_id: 1733045
description:
Nov 24 00:59:43 host2 sshd[721710]: Disconnected from invalid user yhli 118.107.222.220 port 58326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.123
country_id: 3469034
description:
Nov 24 00:59:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=191.53.128.123, lip=66.85.158.91, TLS, session=<Y5ZMEUhERtq/NYB7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 01:00:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8tFeE0hEZN8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.71
country_id: 3865483
description:
Nov 24 01:00:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.1.224.71, lip=66.85.158.91, TLS, session=<dZmKEkhEHaK6AeBH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 01:00:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<iQ30E0hEqIGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 01:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<b37IFkhE7rJ2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 01:01:38 host2 sshd[723130]: Disconnected from invalid user admin 2.57.121.112 port 39463 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.246.128.207
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.246.128.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.180.137.70
country_id: 6252001
description:
Nov 24 01:02:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.180.137.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hYz4GUhETtY0tIlG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 01:02:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<A+jwGUhEJMY+PIcc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.30.78.123
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.30.78.123 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.98.95.183
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 92.98.95.183 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-24 01:02:57 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (batin) [67.172.54.29]:47572: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.95.193.96
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 179.95.193.96 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.150.218.94
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.150.218.94 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.201.160.133
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 79.201.160.133 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 01:04:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<viw6IUhEhuln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 01:03:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<mdNcHkhEpuMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 01:03:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<1RjaH0hEjLQ+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.107.222.220
country_id: 1733045
description:
Nov 24 01:05:06 host2 sshd[725957]: Disconnected from invalid user web 118.107.222.220 port 48184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 24 01:04:28 host2 sshd[725540]: Disconnected from invalid user local 156.236.75.209 port 54190 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.246.4
country_id: 2264397
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 104.28.246.4 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 24 01:05:46 host2 sshd[726364]: Disconnected from invalid user teamspeak 156.236.75.209 port 38102 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 01:06:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wRztJ0hEOM4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 01:06:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<blQjK0hEYpYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 01:06:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<PC4NKkhELCNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 01:08:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<gtBqL0hEzCkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 01:08:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<sGuZL0hEsKnIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 24 01:08:13 host2 sshd[728325]: Disconnected from invalid user local 156.236.75.209 port 58864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 24 01:08:33 host2 sshd[728509]: Disconnected from invalid user test 165.154.200.14 port 34014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 01:10:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7n02NkhEtJtA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 24 01:10:09 host2 sshd[729843]: Disconnected from invalid user kevin 165.154.200.14 port 54804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 24 01:10:32 host2 sshd[730177]: Disconnected from invalid user test 156.236.75.209 port 55782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 01:10:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<m0LFOUhEHLw+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 01:12:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<OfnbPkhEKs+YIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.107.222.220
country_id: 1733045
description:
Nov 24 01:12:42 host2 sshd[731628]: Disconnected from invalid user testuser 118.107.222.220 port 59964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 01:13:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<+MWuQUhEGog+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 24 01:14:55 host2 sshd[733448]: Disconnected from invalid user server 165.154.200.14 port 47114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.225
country_id: 6252001
description:
Nov 24 01:15:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.125.225, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<elObSEhEPpANWX3h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.162.45
country_id: 1861060
description:
Nov 24 01:17:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.211.162.45, lip=66.85.158.92, session=<cvZfT0hEEKgI06It>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 01:17:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<XftjUEhE1tUrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Nov 24 01:17:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS, session=<CpICUUhEtP6TuYRJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 01:18:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Tn4dVkhEMMoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 01:19:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<urJXV0hEXMIv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.247
country_id: 1880251
description:
Nov 24 01:20:28 host2 sshd[737496]: Disconnected from invalid user postgres 101.47.142.247 port 59436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-24 01:21:14 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (eminandive) [73.145.107.251]:57158: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 01:21:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<OqapXkhE5sE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Nov 24 01:21:21 host2 sshd[737996]: Disconnected from invalid user jose 165.154.200.14 port 42110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 01:22:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<xYrmYUhE0Mkv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 01:22:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<rXkqZEhE+LIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 01:24:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<Tpn8akhEHIk+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 01:25:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4s/7bUhEkomPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 01:26:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<FlV1ckhEZqt2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 01:27:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<f8OQdEhE8Oal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 01:27:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<9JwJdUhE6qwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 01:28:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<LLjFdkhECsyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 01:28:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<5QWteEhEBChniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 01:29:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<bjaBekhEvqBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 01:29:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<NbIWfEhE+Lgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2025-11-24 01:31:08 dovecot_login authenticator failed for ([49.125.201.69]) [49.125.201.69]:54884: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 01:30:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<YI4Hf0hE+j8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-11-24 01:31:24 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:39284: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 01:31:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<iPBBhEhEQoQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 01:32:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uKj+h0hElIBA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.247
country_id: 1880251
description:
Nov 24 01:33:10 host2 sshd[746377]: Disconnected from invalid user vpnuser 101.47.142.247 port 42662 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 01:33:38 host2 sshd[746692]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 01:33:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<Ux6RikhE4OPF8xBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.184
country_id: 1819730
description:
Nov 24 01:33:43 host2 sshd[746732]: Disconnected from invalid user grid 154.83.16.184 port 48531 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.64
country_id: 6252001
description:
Nov 24 01:34:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ArjKjkhE0N7N0h9A>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 01:34:55 host2 sshd[747524]: Disconnected from invalid user devante 62.60.131.157 port 34586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 24 01:35:05 host2 sshd[747753]: Disconnected from invalid user s 46.101.206.166 port 43726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 01:35:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<FDd6kEhEUMHIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 24 01:36:05 host2 sshd[748434]: Disconnected from invalid user tester 46.101.206.166 port 58906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.184
country_id: 1819730
description:
Nov 24 01:35:28 host2 sshd[748058]: Disconnected from invalid user dockeruser 154.83.16.184 port 34300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.184
country_id: 1819730
description:
Nov 24 01:37:12 host2 sshd[749188]: Disconnected from invalid user bitnami 154.83.16.184 port 48304 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 24 01:37:05 host2 sshd[749089]: Disconnected from invalid user min 46.101.206.166 port 58792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-24 01:37:42 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:49093: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.19.181.111
country_id: 2623032
description:
2025-11-24 01:37:53 dovecot_login authenticator failed for ([194.19.181.111]) [194.19.181.111]:58488: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 01:37:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<dZUEmkhE9siYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 24 01:38:07 host2 sshd[749759]: Disconnected from invalid user guest 46.101.206.166 port 53900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.16.184
country_id: 1819730
description:
Nov 24 01:38:50 host2 sshd[750170]: Disconnected from invalid user elemental 154.83.16.184 port 34071 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 01:39:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<R8nlnkhEnpM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 01:40:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<eQG8oUhE8Ok+PIcl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.16.184
country_id: 1819730
description:
Nov 24 01:40:23 host2 sshd[751548]: Disconnected from invalid user Test 154.83.16.184 port 48069 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-24 01:41:12 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:44942: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-24 01:41:49 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:56418: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 01:41:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<oHNJqEhEjOcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 01:42:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<a+1Uq0hECpIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 01:45:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<uW7Os0hEXtQv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 01:45:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<CgbctEhEcLYI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.247
country_id: 1880251
description:
Nov 24 01:45:43 host2 sshd[756018]: Disconnected from invalid user user2 101.47.142.247 port 51210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.46.113.143
country_id: 2960313
description:
Nov 24 01:46:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=37.46.113.143, lip=66.85.158.91, session=<HjBzt0hENFwlLnGP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 01:47:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<OBdiu0hE+Jsv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 01:49:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<RPY7xUhExNw+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 01:50:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VUzDx0hEMTBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 01:50:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<n79GyEhEiM+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.15.98.132
country_id: 3865483
description:
Nov 24 01:51:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=181.15.98.132, lip=66.85.158.91, TLS, session=<MMbYx0hEDqW1D2KE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 01:52:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ksPpzEhEUM0EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.26
country_id: 3469034
description:
Nov 24 01:51:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.130.168.26, lip=66.85.158.91, TLS, session=<JK8zyUhEuZmxgqga>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 01:53:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=</J7O0EhEzqIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 01:52:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1fopz0hEBAwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 01:52:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<0tivz0hEXLR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.5
country_id: 1269750
description:
Nov 24 01:54:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.5, lip=66.85.158.91, TLS, session=<sROi00hElJdnEqYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 01:54:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<anqi1EhEGt5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.233.113.237
country_id: 798544
description:
Nov 24 01:53:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=91.233.113.237, lip=66.85.158.91, TLS, session=<Kpx00khExoxb6XHt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 01:55:50 host2 sshd[763926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 01:55:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<w9zB2UhE+ORA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 01:57:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<enlN3khEgOAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 01:57:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pmGK3khEdp2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 01:57:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fgCJ4EhEIKyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 02:01:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<e7F77UhEjNg+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 02:02:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<DX5b8khEGt3IMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-24 02:02:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64788: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 02:03:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<CYLo9khEHsCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 02:04:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<30wG+UhEWsAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 02:08:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<QdxMBklEatsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 02:08:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<dqfzBklEwMw+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 02:08:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DMYGCElEwL0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 02:12:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PMhnFElEiqII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 02:12:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ZaOEFElE4IUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-24 02:12:32 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:42343: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 02:12:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yYX9FklETzdniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-24 02:13:00 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:36112: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 02:15:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<OMGBH0lETtYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 02:16:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ml+UIklEPMqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 02:15:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<JlkmIUlEqLI+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 02:16:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<StaMJElE8sQ+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 02:17:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<J4tFJklE2Iwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 02:17:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<se7UJklE7JgEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 02:17:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<diXwJ0lEMuQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 02:18:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<QM9RK0lEHrtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 02:18:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<qWfVK0lEZNA+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 02:19:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<rILcLUlEqoJ2wSaf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 02:19:58 host2 sshd[782755]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 02:19:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<cgpDMElE1opn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 02:20:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<mBcVMklExLA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 02:22:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<NqzoOElEbM4v+yXY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.126.89.105
country_id: 660013
description:
Nov 24 02:26:02 host2 pure-ftpd[787162]: (?@188.126.89.105) [INFO] New connection from 188.126.89.105


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.32.20
country_id: 3508796
description:
Nov 24 02:26:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.32.20, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5y5nRklEyrit9CAU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.172
country_id: 1269750
description:
Nov 24 02:26:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=103.108.174.172, lip=66.85.158.91, TLS, session=<XcVoRklE2rhnbK6s>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.42.147
country_id: 1835841
description:
Nov 24 02:25:51 host2 pure-ftpd[787008]: (?@173.244.42.147) [INFO] New connection from 173.244.42.147


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.238.183
country_id: 6252001
description:
Nov 24 02:26:03 host2 pure-ftpd[787172]: (?@95.181.238.183) [INFO] New connection from 95.181.238.183


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.162.164
country_id: 146669
description:
Nov 24 02:26:04 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=185.253.162.164, lip=66.85.158.91, session=<0jlhRklEwsW5/aKk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.178
country_id: 6252001
description:
Nov 24 02:26:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.238.178, lip=66.85.158.91, session=<+A1kRklEwMVfte6y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.5
country_id: 1655842
description:
Nov 24 02:26:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.64.98.5, lip=66.85.158.91, session=<Gjl5RklECJhAQGIF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 02:26:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<griiSElEEIul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 02:26:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<O1IQSUlENuOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 02:26:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<J6Z1SUlEmpAv+3xn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 02:27:06 host2 sshd[787949]: Disconnected from invalid user admin 2.57.121.112 port 17332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.162
country_id: 6252001
description:
Nov 24 02:27:27 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.162, lip=66.85.158.92, session=<qIJTS0lEMipC5DWi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 02:28:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<bZE8T0lEqtfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 02:30:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Lp0eVUlEfriYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 02:31:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ZI86WElEBL0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 02:34:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<r7IBZUlEqOkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 02:35:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<cZhxZklEqT1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 02:36:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<tsy0bElE2Nwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 02:36:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<5rOZbElEUsg+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 02:37:33 host2 sshd[795335]: Disconnected from invalid user devante 62.60.131.157 port 6360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 02:37:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LwPab0lEqhUvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 24 02:39:05 host2 sshd[796747]: Disconnected from invalid user tidb 36.95.194.54 port 48378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 02:39:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<NFCedUlEOtQ+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 02:39:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<8P23dElEZI4I04Sw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 24 02:40:26 host2 sshd[797709]: Disconnected from invalid user sysadmin 36.95.194.54 port 57028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 02:41:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<oZy/fElEPOUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 02:41:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<e6SSfUlEzotA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 02:41:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<YFvTfUlECIaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 02:41:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<PMYFfklESro+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-24 02:41:49 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:42008: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-24 02:41:22 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:38132: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 02:42:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<mHWKgElEgtwEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.54
country_id: 1643084
description:
Nov 24 02:44:20 host2 sshd[799932]: Disconnected from invalid user server 36.95.194.54 port 53246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 02:45:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=</Fu0iklE1KFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 02:45:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<3AqijElEyN92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 02:47:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<yWepkklEosTF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 02:48:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<o0zxlElEjLwv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 02:49:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<GV79mElEDog+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 02:49:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<aX7RmklEnMov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 02:50:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<iXB8nUlEsKY+PIcr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.60
country_id: 6252001
description:
Nov 24 02:50:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.60, lip=66.85.158.92, session=<9KH8nklENOKTuYQ8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.196
country_id: 1733045
description:
Nov 24 02:51:54 host2 sshd[804913]: Disconnected from invalid user user3 202.165.17.196 port 59910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-24 02:52:34 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:46398: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.239
country_id: 1269750
description:
Nov 24 02:53:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.70.126.239, lip=66.85.158.91, TLS, session=<3hrCpklEM9FnRn7v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.56.74
country_id: 798544
description:
Nov 24 02:53:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=155.133.56.74, lip=66.85.158.91, TLS, session=<bAEgqElEfwubhThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 02:54:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1baUqklEMow+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.196
country_id: 1733045
description:
Nov 24 02:54:31 host2 sshd[807034]: Disconnected from invalid user ts2 202.165.17.196 port 59098 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 02:54:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<mXVzq0lEeIov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 02:55:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<PydOsElEbrrIMGRT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.17.196
country_id: 1733045
description:
Nov 24 02:55:53 host2 sshd[807858]: Disconnected from invalid user gitlab-runner 202.165.17.196 port 42820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 02:55:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<5lEosUlEBqo+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 02:56:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<PeV7sklE2MqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 02:56:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<AWens0lEoK2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 02:57:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<oMABtUlE7rGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 02:57:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<OT+NtklEkkVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 03:00:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<IyVVwklEYKcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 03:00:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<Mn8TwUlEVo0FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 03:00:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Z9aAwUlE1j0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 03:01:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<HjeExklEvsUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 03:02:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<slCyx0lELuI+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.196
country_id: 1733045
description:
Nov 24 03:02:25 host2 sshd[811700]: Disconnected from invalid user ariel 202.165.17.196 port 44954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 03:04:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<HktZ0ElElKc+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 03:04:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<PSqV0ElEHoBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 03:05:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<WiHK1ElELs8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 03:06:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<CG771UlEoOgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 03:08:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<mvSK3ElEfJYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 03:07:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lgjZ2UlELpyPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-24 03:09:55 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:42583: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-11-24 03:10:14 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:37084: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 03:10:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<UCDf5UlE6odn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-11-24 03:10:55 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:37662: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.128.32
country_id: 6252001
description:
Nov 24 03:12:07 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=143.198.128.32, lip=66.85.158.91, TLS, session=<YR8O60lEyoiPxoAg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Nov 24 03:13:12 host2 sshd[820232]: Disconnected from invalid user sga 142.93.126.22 port 51738 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 03:13:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<j62f8UlErqov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.68
country_id: 298795
description:
Nov 24 03:16:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=45.67.155.68, lip=66.85.158.91, TLS, session=</NU3+0lE4rgtQ5tE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Nov 24 03:16:57 host2 sshd[823014]: Disconnected from invalid user bot 142.93.126.22 port 42508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.126.22
country_id: 6252001
description:
Nov 24 03:18:01 host2 sshd[823571]: Disconnected from invalid user admin1 142.93.126.22 port 47396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.5.141
country_id: 798544
description:
Nov 24 03:17:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=89.186.5.141, lip=66.85.158.91, TLS, session=<Nm1L/ElEhLpZugWN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 03:17:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<8o+C/0lENtEv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 03:18:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<z7kJAEpETq8+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.126.22
country_id: 6252001
description:
Nov 24 03:20:08 host2 sshd[824960]: Disconnected from invalid user deamon 142.93.126.22 port 49650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 03:20:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<BjboB0pEDElniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 03:23:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<oHDBE0pEJngvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 03:23:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<6xJlFEpEPu7IMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-24 03:23:42 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:48198: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-24 03:23:55 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:42232: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 03:24:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<wVVgF0pEyq2YIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.43.55.121
country_id: 1668284
description:
Nov 24 03:25:37 host2 sshd[828454]: Disconnected from invalid user newuser 45.43.55.121 port 38930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 03:25:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<IO9jHEpEOI6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 03:26:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<FQYLIEpEbOil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 03:28:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+6rsI0pELrVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 03:27:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<r7QqIUpEatQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 03:27:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<q8W0IUpEpK4v7PP+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 03:29:13 host2 sshd[830926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.43.55.121
country_id: 1668284
description:
Nov 24 03:29:27 host2 sshd[831039]: Disconnected from invalid user vendas 45.43.55.121 port 41706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 03:30:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gCi9LEpEvLov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 03:31:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<i6WOLkpECNo+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 03:31:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<DznVMUpEOLo+PIco>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 03:33:51 host2 sshd[834008]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 03:33:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<joTNNkpEpMaPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.43.55.121
country_id: 1668284
description:
Nov 24 03:33:29 host2 sshd[833816]: Disconnected from invalid user server 45.43.55.121 port 48394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 03:33:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<sTaxN0pE4NQI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 03:34:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<PH9GOkpE/oMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 03:35:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<niDHP0pEWrov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 03:36:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iZTtQkpE+oVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.227
country_id: 3469034
description:
Nov 24 03:38:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=191.240.96.227, lip=66.85.158.91, TLS, session=<c26oR0pEu4W/8GDj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.137.66
country_id: 690791
description:
Nov 24 03:38:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.137.66, lip=66.85.158.91, TLS, session=<cA7ZSEpEOesl3YlC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 03:39:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<H9t/TEpEGM8+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 03:40:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<CfDaT0pEzpgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 03:40:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<XtroT0pE3o12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 03:41:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<zWxeVEpESu0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 03:43:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<u8ndWUpE9Alniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 03:42:57 host2 sshd[841336]: Disconnected from invalid user emerald 62.60.131.157 port 46690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-24 03:43:18 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:39271: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-24 03:43:32 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:41218: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 03:46:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<lAJtZkpEhBkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 03:48:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<OiuEbUpEtuk+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 03:51:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<HanfdkpEfJ7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 03:51:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<LGvkd0pEOoVA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-24 03:52:23 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:38258: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-24 03:52:40 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:22798: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 03:52:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<rwq7ekpEHqiYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.161.79
country_id: 614540
description:
Nov 24 03:53:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=5.133.161.79, lip=66.85.158.91, TLS, session=<+REifUpEIZkFhaFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 03:53:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2rWzfkpEUJcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.221.253
country_id: 3469034
description:
Nov 24 03:53:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.87.221.253, lip=66.85.158.91, TLS, session=<LKZSfkpEJbyxV939>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 03:54:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<gQPvgEpExt4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 03:55:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4EoMhUpEiqQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 03:56:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<2S3xh0pESLqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 03:57:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+czHjkpEoNKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 03:58:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<fMSAkkpEhoMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 03:59:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bdDCk0pEVtuPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 24 04:00:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<Ldwcl0pE6JhChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.213
country_id: 6252001
description:
Nov 24 04:00:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.213, lip=66.85.158.91, TLS, session=<N/OrmEpE8OnG6xjV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 04:00:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<uGW9mUpESMEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 04:01:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<KLPimUpEhMgEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 04:01:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<zJRdm0pEtKI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 04:02:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<1weynUpEFsA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 04:02:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mKKjoEpEEIxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-24 04:03:04 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:39994: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-24 04:03:19 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:58742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 04:04:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<tnXLpEpEkrc+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 04:05:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ftRIqEpEpLgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 04:06:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GoFwrEpEmBFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 04:06:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<7fDbrUpEAIcv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 04:07:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WzgnsEpEwoI+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 04:08:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6ZDns0pESo12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 04:09:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<RZbhuUpE2hUvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.188.246
country_id: 6252001
description:
Nov 24 04:13:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 1 secs): user=<>, rip=148.153.188.246, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<j07bxUpEarGUmbz2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 04:15:25 host2 sshd[878358]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 04:15:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<B9LDzEpE+rxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 04:15:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<1VdMzkpELtsFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 04:18:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rNpM2EpE/tHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 04:19:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<V4nI2kpEOu4v7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.6
country_id: 2635167
description:
Nov 24 04:19:54 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.6, lip=66.85.158.92, TLS, session=<UfR53UpEf9G594kG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.199
country_id: 2635167
description:
Nov 24 04:20:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.199, lip=66.85.158.92, TLS handshaking: Connection closed, session=<thJX3kpEfdVX7LDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 04:19:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<IaAg3UpE6I4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 04:19:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QywY3UpEJKSYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.193
country_id: 2635167
description:
Nov 24 04:20:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.193, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<oaFS4EpEtZxX7LDB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.208
country_id: 2635167
description:
Nov 24 04:21:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.208, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<k2RO4kpE761X7LDQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 04:21:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Fu+c40pEJsQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.209
country_id: 2635167
description:
Nov 24 04:21:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.209, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<X6ZJ5EpEsbS594nR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 04:22:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<9S3m5UpEsKYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 04:22:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<xMX45UpE6oA+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.214
country_id: 2635167
description:
Nov 24 04:22:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.214, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<WRpF5kpE6dNX7LDW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.194
country_id: 2635167
description:
Nov 24 04:23:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.194, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<1Mo76kpE/52594nC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.191
country_id: 2635167
description:
Nov 24 04:22:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.191, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<p4E+6EpEq9tX7LC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.189
country_id: 2635167
description:
Nov 24 04:24:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<+Y4w7kpEvc9X7LC9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov 24 04:24:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<TTo37EpEq6tX7LDC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 04:25:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<IT6i70pE+K4+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.185
country_id: 2635167
description:
Nov 24 04:25:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.185, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<qPQr8EpE7b6594m5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 04:25:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qSpd8UpEkLWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 04:26:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<eSh39UpEvr+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 04:27:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<B34U90pEaLMEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Nov 24 04:27:06 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, session=<t+M490pEjoOs7OT1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 04:28:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<jxXu+0pE+MMv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 04:29:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<tq8F/0pEIOQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 04:29:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<H0Zm/0pExhdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 04:29:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<61Wj/0pEDoKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 04:28:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<vTuB/EpEWK0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 04:28:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MSu1/EpEpJpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 04:30:09 host2 sshd[894584]: Disconnected from invalid user user 2.57.121.25 port 38238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 24 04:32:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<xepXCktE8s2SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 04:33:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<U61nDEtEdOMv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 04:33:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2So2DUtEruovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 04:35:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<lbSlFEtE0KJ2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 04:38:33 host2 sshd[901187]: Disconnected from invalid user admin 2.57.121.112 port 61930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 04:38:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<+r22IEtEJKI+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.168
country_id: 6252001
description:
Nov 24 04:39:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.168, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tbbbIUtEnNzG6xio>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 04:39:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1otHI0tEwJJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 04:41:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<m0BLK0tE+KI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 04:42:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+4y1LEtEopQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 04:44:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<iXSHM0tEkJw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 04:44:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ky4nNEtEPtcv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 04:43:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<z/BkMktEtJs+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 04:45:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<1jlKN0tE3MTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 04:44:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<V7g9NktE+uYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 04:46:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<XA5tPEtEZJ2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 04:45:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<F6QqOktE0oIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 04:47:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Wgy+QUtEfoIrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Nov 24 04:48:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, TLS, session=<PudHRUtEQu7G6xh5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 04:51:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kZEbUEtEgrAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 04:52:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<29ITUUtEYIwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 04:53:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eFywVEtEISBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 04:52:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TN9gUktEBqiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 04:53:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<hQARV0tECoJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.207
country_id: 3469034
description:
Nov 24 04:57:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.136.207, lip=66.85.158.91, TLS, session=<8ZE0YUtELuu+WYjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.34
country_id: 953987
description:
Nov 24 04:56:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.46.34, lip=66.85.158.91, TLS, session=<RbTqX0tEL+JmQC4i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 04:56:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<clqnYUtElJkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 04:56:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1Fa8YUtEqtgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 04:57:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<aOBwZEtErJaWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 05:00:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<+HvMbUtE1NEv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 24 05:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, TLS: Connection closed, session=<XtcpcUtE/L6UccE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 05:01:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<mv4BcktEKsKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 05:01:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<fDuwc0tENuZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 05:02:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<6frtdktEFNA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 05:04:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DLMXfUtEvN1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 05:08:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<sm6IiktEIuI+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 05:08:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ID3WjEtE7L8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 05:10:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<o4z5kUtEXtEv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 05:09:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<72MBkEtEXqAv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.32
country_id: 6251999
description:
Nov 24 05:11:16 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.32, lip=66.85.158.91, session=<4XMwlUtE+KhWNh8g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 05:11:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<sF9olktExJnIMGRT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.148.26.145
country_id: 2802361
description:
Nov 24 05:11:47 host2 pure-ftpd[925061]: (?@146.148.26.145) [INFO] New connection from 146.148.26.145


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 24 05:12:10 host2 sshd[925276]: Disconnected from invalid user test 137.184.111.54 port 48680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 05:13:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<rgrEm0tEiJaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 05:14:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<KnL5n0tETKHF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 05:14:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<mYIOn0tEsK4rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-24 05:15:16 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:56475: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 05:15:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<svPMpUtEbqov7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 24 05:16:17 host2 sshd[927878]: Disconnected from invalid user elemental 137.184.111.54 port 47420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.182.175
country_id: 3469034
description:
2025-11-24 05:15:37 dovecot_login authenticator failed for ([177.10.182.175]) [177.10.182.175]:53996: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-24 05:15:51 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:46750: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 05:17:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<6uuYqktErqkEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 24 05:17:19 host2 sshd[928524]: Disconnected from invalid user init 137.184.111.54 port 44758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 05:17:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HUG5q0tEewZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.111.54
country_id: 6252001
description:
Nov 24 05:18:19 host2 sshd[929170]: Disconnected from invalid user test1 137.184.111.54 port 35012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.44
country_id: 798544
description:
Nov 24 05:18:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.216.25.44, lip=66.85.158.91, TLS, session=<lMsJrktEv7yy2Bks>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 05:17:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<iG17rEtEzOE+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.185
country_id: 3469034
description:
Nov 24 05:18:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.105.185, lip=66.85.158.91, TLS, session=<wNqzrEtEps27eGm5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 05:19:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HqTgsUtEWMln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 05:20:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nX78tEtE2MePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 05:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<93fOuEtEIJE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 05:20:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NaHGtktE0oMvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 05:24:32 host2 sshd[933439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 05:25:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ZomZx0tEUoYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 05:28:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Ttkx0UtEZsAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 05:28:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<UipQ0ktEkKOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 05:28:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<c/bm00tETr12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 05:31:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<cqbG3ktEFOY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 05:31:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<J8Lu3ktEhrk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 05:33:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<PzME40tEfKY+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 05:33:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<4OLW5EtEpLKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 05:34:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<PuPh50tE+Kgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 05:33:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DF0+5ktE1OBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 05:33:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<5uhG5ktEkLs+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 05:34:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<i+Hq5ktEZMQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 05:36:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1jz+7UtEJLwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 05:38:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<Mq+y9ktE7rHIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-11-24 05:40:00 dovecot_login authenticator failed for ([103.67.152.201]) [103.67.152.201]:57170: 535 Incorrect authentication data (set_id=monnierbenoitmichel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 05:40:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<HxhL/UtEdJGYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-11-24 05:39:37 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:45082: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 05:39:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<B9zZ+ktEwLsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 05:40:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+nzZ/ktEGtwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 05:41:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<vkXm/0tEMME+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 05:41:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<0F50AkxECro+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 05:41:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7gHeAkxEUA1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 05:42:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<V9nwBUxEzt8EkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 05:43:02 host2 sshd[945525]: Disconnected from invalid user  2.57.121.112 port 61573 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 05:44:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<HB1HCkxEYLgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 05:45:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<E/yJDkxEoLxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-24 05:45:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59315: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 05:46:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<SvQXEkxEeMg+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 05:47:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uZjjFkxEtJyPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 05:47:41 host2 sshd[948909]: Disconnected from invalid user user 2.57.121.25 port 26069 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.175
country_id: 6252001
description:
Nov 24 05:48:11 host2 pure-ftpd[949194]: (?@205.210.31.175) [INFO] New connection from 205.210.31.175


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 05:53:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<P7O3K0xEdMg+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 05:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<MZ3bLUxEJOEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 05:54:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<djl8MExEmrQ+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 05:55:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<fUbsNExEMK8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 05:56:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<hNeqNkxEAKF2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-11-24 05:57:18 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:58924: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-11-24 05:56:54 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:49619: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 05:58:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<i7IMP0xE7LIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 05:58:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uaCaP0xEXrNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 05:59:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Zk4WQ0xEqKSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 06:00:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Z2tLRkxE/pIv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.244.90.247
country_id: 6252001
description:
2025-11-24 06:01:07 dovecot_login authenticator failed for 108-244-90-247.lightspeed.frokca.sbcglobal.net ([127.0.0.1]) [108.244.90.247]:53981: 535 Incorrect authentication data (set_id=info@monarchdss.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 06:02:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vqexSkxEJqYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 06:04:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<loPFUUxEZN4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 06:05:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<zKgrV0xETo8+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 06:06:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</N2KWkxEjxVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 06:06:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<0dSzWkxESJHIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.252
country_id: 3895114
description:
Nov 24 06:06:24 host2 sshd[961294]: Disconnected from invalid user osboxes 186.64.123.252 port 42822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 06:06:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cXs7XExEANWl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 24 06:07:14 host2 sshd[961739]: Disconnected from invalid user minecraft 79.59.175.196 port 35392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 06:07:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<+GLFXUxEBI8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 06:07:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<ECF8XkxE1oY+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 06:08:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<G2mJYExEpq8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 06:08:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<zOC2YExE2pGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 06:07:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nwPuX0xEiJsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 06:08:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<2UrsYkxEtrsEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 24 06:09:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nHq5Y0xEehVChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.252
country_id: 3895114
description:
Nov 24 06:09:20 host2 sshd[962968]: Disconnected from invalid user sistemas 186.64.123.252 port 57798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 06:09:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<Lvv/ZUxEhr0+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 06:09:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VpZ4ZkxErrA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 06:10:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<Qa4VaExEiLE+PIco>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 06:10:50 host2 sshd[963922]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 06:10:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PqW1aUxEnr1n9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 24 06:11:20 host2 sshd[964253]: Disconnected from invalid user root1 79.59.175.196 port 53250 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 24 06:12:03 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS, session=<sJuPbkxEYNZQUk2L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 24 06:12:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<I2aZbkxEPNxQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-24 06:12:22 dovecot_login authenticator failed for ([12.150.243.20]) [12.150.243.22]:3806: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 24 06:15:41 host2 sshd[967229]: Disconnected from invalid user user1 79.59.175.196 port 49736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 06:15:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<O5rSeUxE9NKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Nov 24 06:16:44 host2 sshd[967853]: Disconnected from invalid user odoo 79.59.175.196 port 48850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.252
country_id: 3895114
description:
Nov 24 06:16:18 host2 sshd[967673]: Disconnected from invalid user carlos 186.64.123.252 port 54778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.64.123.252
country_id: 3895114
description:
Nov 24 06:17:40 host2 sshd[968361]: Disconnected from invalid user magento 186.64.123.252 port 54156 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:17:55 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<9FKMg0xEIMUDg9cm>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.178.191.71
country_id: 2782113
description:
Nov 24 06:17:28 host2 sshd[968260]: Disconnecting authenticating user root 62.178.191.71 port 56388: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.178.191.71
country_id: 2782113
description:
Nov 24 06:17:28 host2 sshd[968260]: error: maximum authentication attempts exceeded for root from 62.178.191.71 port 56388 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.178.191.71
country_id: 2782113
description:
Nov 24 06:17:37 host2 sshd[968339]: error: maximum authentication attempts exceeded for invalid user admin from 62.178.191.71 port 57920 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:20:16 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<zaPti0xE/s0Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:21:52 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<LlKskUxE/ukDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 06:22:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<iaAQlUxEhswI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:23:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<ZAL+mExEwNwDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 06:24:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<oskxmUxEvp0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 06:24:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<cNuLmUxEWLJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 06:23:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<osl+lkxESp4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 06:24:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<hACmmkxEAMFA44h6>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:24:33 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<9olAm0xEIKQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 06:26:22 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<k0PMoUxE1pQDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 06:26:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<3avBokxESOov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 06:26:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<tVTBokxEDOg+PIcl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 24 06:27:36 host2 sshd[974430]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 06:27:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Z4oGpkxEPJAv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Nov 24 06:27:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<muNsp0xEQ8vG6xjw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 24 06:30:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=<GnMPr0xEHL6UcdOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 06:29:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<tQYrrExEwMgv7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.216.105
country_id: 6251999
description:
Nov 24 06:31:25 host2 pure-ftpd[976886]: (?@148.113.216.105) [INFO] New connection from 148.113.216.105


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.216.105
country_id: 6251999
description:
Nov 24 06:31:40 host2 pure-ftpd[977013]: (?@148.113.216.105) [INFO] New connection from 148.113.216.105


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 06:31:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+pjytExE9B9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 06:32:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<A+n2tUxEStiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 06:33:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Z9ZkuUxE7kUvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 24 06:32:16 host2 sshd[977369]: Disconnected from invalid user ansible 186.103.169.12 port 44028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 06:33:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<eyg6u0xEjo8+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 24 06:33:49 host2 sshd[978448]: Disconnected from invalid user yhli 186.103.169.12 port 58056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 06:33:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<iltrvExEtpzIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 06:34:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Atw0v0xErrgEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 06:34:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jzhtv0xEWMgrpAFm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.220
country_id: 6252001
description:
Nov 24 06:34:11 host2 sshd[978690]: Disconnected from invalid user leo 45.61.187.220 port 33514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 06:35:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<k5aqwkxExpGYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 24 06:35:16 host2 sshd[979860]: Disconnected from invalid user test 186.103.169.12 port 36264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 06:35:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<s6DJwUxEErNn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Nov 24 06:35:25 host2 sshd[979968]: Disconnected from invalid user user 45.61.187.220 port 59478 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Nov 24 06:36:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.255, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wvbOxkxECdXG6xj/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 24 06:36:51 host2 sshd[981285]: Disconnected from invalid user ben 186.103.169.12 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 24 06:36:22 host2 sshd[980835]: Disconnected from invalid user backup 122.53.133.167 port 34902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.92
country_id: 1819730
description:
Nov 24 06:38:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.92, lip=66.85.158.91, TLS, session=<6M9gy0xE/Mwtjppc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.92
country_id: 1819730
description:
Nov 24 06:38:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.92, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<t7LHy0xEpNMtjppc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 06:38:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<d3DFzExEXKY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 06:41:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oTRU1kxEmuGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 24 06:40:16 host2 sshd[985131]: Disconnected from invalid user steam 186.103.169.12 port 47246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 06:41:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hi9l2ExEBp2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Nov 24 06:43:32 host2 sshd[988300]: Disconnected from invalid user user8 122.53.133.167 port 44674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 24 06:46:54 host2 sshd[992804]: Disconnected from invalid user ansible 205.185.127.60 port 35058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 06:48:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<G3Wr70xEKOgv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 06:50:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<yChZ+UxECowv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 06:50:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<EtbZ90xEsrgI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 24 06:50:30 host2 sshd[997465]: Disconnected from invalid user administrator 205.185.127.60 port 39282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 06:50:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<nNrH+ExETLFA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.127.60
country_id: 6252001
description:
Nov 24 06:52:07 host2 sshd[999396]: Disconnected from invalid user ntps 205.185.127.60 port 41394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 06:51:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=</iJ3+kxEZK12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 06:52:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<CU1e/UxEQtMv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 06:52:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<I7hG/kxE1ugv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 06:55:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<6iWsCE1E9IUv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-24 06:56:58 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:50383: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-11-24 06:57:18 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:53667: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 06:57:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<a9wZEU1E/yhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 06:58:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MI6UFE1EvngvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 06:58:41 host2 sshd[1006094]: Disconnected from invalid user marlee 62.60.131.157 port 23711 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 07:00:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<T9rSGk1EhJln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 07:00:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<7rRnG01EFsgEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 07:00:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<x3k1HU1EeqHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 07:01:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<qsQXH01E4ocrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 24 07:02:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Bi4nJE1ErJGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 07:04:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Iy4wK01EDK2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 07:07:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<5p40NE1EEs0+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 07:08:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zTQ/N01EVOWPbtX3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.235.189.146
country_id: 1880251
description:
Nov 24 07:09:22 host2 pure-ftpd[1013126]: (?@15.235.189.146) [INFO] New connection from 15.235.189.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 15.235.189.158
country_id: 1880251
description:
Nov 24 07:09:27 host2 pure-ftpd[1013185]: (?@15.235.189.158) [INFO] New connection from 15.235.189.158


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 07:10:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<CK4UP01E5pY+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 07:10:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<h7WQP01EzJwFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-24 07:11:15 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:26292: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-24 07:11:24 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:53986: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 07:13:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<EkbxSE1EnpIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 07:16:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<bdxEU01E1sSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 07:17:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<HWADV01EXrxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 07:17:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<QAsJWE1E8NIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 07:17:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<fAXwWE1E9Lsv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 07:18:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<zG7YWk1EsOgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 07:18:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<6R0XW01EtKQI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 07:18:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<NmnHXE1E/LF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 07:21:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ba4HZk1EoOIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 07:21:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<uSRvaE1EYoo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 07:23:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<S6pCbk1EijBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 07:24:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<bQYQcU1ERl0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 07:25:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<q7vrdU1EupJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 07:25:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<G6p5dk1EtLc+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 07:26:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<gLXbeE1EiNk+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 07:26:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<sMmSeU1ENtEEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 07:28:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<BjQZf01EfrPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 07:28:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<YldhgE1EVrYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.11
country_id: 719819
description:
Nov 24 07:28:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=178.48.181.11, lip=66.85.158.91, TLS, session=<pbiif01EdL6yMLUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.23
country_id: 953987
description:
Nov 24 07:29:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.46.23, lip=66.85.158.91, TLS, session=<fdnIgE1E265mQC4X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.75
country_id: 933860
description:
Nov 24 07:32:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.209.75, lip=66.85.158.91, TLS, session=<DX9vi01Erpcp2NFL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.51.118.10
country_id: 3469034
description:
Nov 24 07:31:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=189.51.118.10, lip=66.85.158.91, TLS, session=<6Fc2ik1Eyb69M3YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 07:32:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<DzMIjk1E7JE+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-24 07:33:10 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:51668: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 07:34:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JF4Ilk1E4MSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 07:35:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<2FwEmU1EUuMFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 158.69.125.92
country_id: 6251999
description:
Nov 24 07:36:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=158.69.125.92, lip=66.85.158.91, session=<ql8Fnk1EBIaeRX1c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.19
country_id: 3469034
description:
Nov 24 07:37:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=201.159.85.19, lip=66.85.158.91, TLS, session=<BnQOn01EI7LJn1UT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 24 07:37:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<wxfdnU1ErYCynG0e>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 24 07:39:05 host2 pure-ftpd[1034580]: (?@104.236.209.11) [INFO] New connection from 104.236.209.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 07:38:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<wgmEok1EYpUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 07:38:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<WtnDo01ECuqWXx+e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 24 07:38:53 host2 pure-ftpd[1034384]: (?@104.236.209.11) [INFO] New connection from 104.236.209.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 24 07:41:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<tmKWrE1EdM3F8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 07:42:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<WQiasU1ECr0v+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 07:43:18 host2 sshd[1037206]: Disconnected from invalid user neha 62.60.131.157 port 22894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 07:43:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<w6o9tk1ERN1A44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Nov 24 07:43:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.108, lip=66.85.158.91, session=<pxh+tk1EbP7G6xhs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 07:43:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ZWzwtk1EnKQv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.56
country_id: 6252001
description:
Nov 24 07:43:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.56, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DClbt01E59fN0h84>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 07:45:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<PXOku01EEtcv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 07:45:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<c7SRvU1E7pAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 07:46:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<BN7qwE1EaJZ2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 07:47:18 host2 sshd[1040162]: Disconnected from invalid user admin 2.57.121.112 port 22374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 07:47:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ngBhxE1EKokv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 07:49:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dE6lyk1Eyjpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 07:51:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<w5my0E1EkHkvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-24 07:50:51 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:51210: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-24 07:51:09 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:34226: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 07:51:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<vYQE001Ect5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 07:51:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<7E/S001E9IKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 24 07:53:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<VF5r2k1E2JYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 07:54:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<v7dv3U1ERrw+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 07:56:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<1+YK401EnuUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 07:56:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<T2w9401ECM7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 07:56:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<Epds401EfIw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 24 07:56:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<zjPI401EloI+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 07:58:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<7VOi601EAtU+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 08:01:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PGA69U1EbpGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 08:02:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<wbwR+k1EisY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 08:03:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<D6NF/k1EHJ0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 08:04:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<2Oq+AE5EqMI+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 08:07:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7+ZhC05E9qYv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 08:07:52 host2 sshd[1053361]: Disconnected from invalid user support 2.57.121.112 port 62317 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 08:10:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<EnjNFU5EDo4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 08:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xDeBFk5EcLJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 08:13:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VcCQIE5EaOwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.97.40
country_id: 3469034
description:
Nov 24 08:13:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.224.97.40, lip=66.85.158.91, TLS, session=<z6AJIE5En5W64GEo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.59
country_id: 3175395
description:
Nov 24 08:13:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.9.59, lip=66.85.158.91, TLS, session=<3v87IU5E5c65xQk7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 08:13:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<C5FaIE5EMs6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 08:14:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<uxLbI05ExrYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 08:15:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<BfNnJ05EuKV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 08:15:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<94wOKU5Eh0Nniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 08:17:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<3DLZL05EhNVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 08:18:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<cwH9ME5EFoQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.34.18
country_id: 226074
description:
Nov 24 08:19:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=196.0.34.18, lip=66.85.158.91, TLS, session=<y4eFNk5EnsHEACIS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.249
country_id: 3865483
description:
Nov 24 08:20:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=45.177.200.249, lip=66.85.158.91, TLS, session=<rhzaN05EDqctscj5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 08:20:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<7gHsOk5EsJY+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 08:24:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<h0FeRk5EEqYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 08:24:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<snuBSE5ENM7IMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-24 08:26:28 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:44286: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-24 08:26:56 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:36757: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 08:28:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<REadVU5EpNePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 08:28:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<hKMkV05EhOul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 08:29:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zTLFWk5E7o8v+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 24 08:30:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<MwZlXE5EdlhChJl/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 08:31:47 host2 sshd[1068716]: Disconnected from invalid user admin 2.57.121.112 port 9219 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 08:33:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cgGLZ05E2pAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 08:36:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<4jCMc05EFOYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 08:37:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Gs3MdU5ENoRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 08:40:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Bijdf05EKKM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 08:40:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<T0gdgU5EKrQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 08:40:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<uVAlgU5EOr0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 08:41:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<lPR4hU5E3NcI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 08:42:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nnQkiU5EQk1niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.29
country_id: 1819730
description:
Nov 24 08:44:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.29, lip=66.85.158.92, TLS handshaking: Connection closed, session=<s0MXjk5EHqMtjpod>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 08:43:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<63d2jU5EopN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 08:43:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<eCCMjU5EKpBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 08:44:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<sNYCj05E/LEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 08:45:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<KddglE5EFJc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-24 08:46:55 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:45837: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.145
country_id: 1819730
description:
2025-11-24 08:46:32 dovecot_login authenticator failed for 145.47.246.220.static.netvigator.com [220.246.47.145]:55556: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 08:48:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<1Zw6nk5EwtWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 08:51:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Eq7kp05EOsI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 08:51:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<dCo4qk5EBtUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 08:53:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<9AXjrk5EXIHIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 08:54:22 host2 sshd[1085361]: Disconnected from invalid user user 2.57.121.25 port 35011 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 08:55:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hlXit05ECM+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 08:55:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<u4pHtk5EaIMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 08:58:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<6edGwU5EHso+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 08:59:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<179IxU5EHOkv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 09:00:13 host2 sshd[1089556]: Disconnected from invalid user arnold 62.60.131.157 port 41214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 09:01:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<BVu1y05EhKA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 09:03:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</4X00k5EPtAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 09:03:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<rtk81E5EgOBA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 09:04:50 host2 sshd[1092765]: Disconnected from invalid user admin 2.57.121.112 port 17857 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-24 09:05:31 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:48494: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 09:05:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cp9m3E5E3Iul6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 09:05:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<wQFx3E5EoLQv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-24 09:06:10 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:56114: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:07:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YX8v4U5EStMDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 09:08:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<i4+z5k5E0KIv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:09:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mGq0505E1sgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:09:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<O2eU6k5EEMwDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 09:09:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ijcM6k5EyQxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 09:10:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<x5K6605E9N8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 09:10:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<fj1t7E5EPMQI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:10:51 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<T3QA7k5EeJIDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 09:10:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<luLT7U5EaoFn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:11:39 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<FHzj8E5E/qIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:12:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2XaN9E5EfsgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:13:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3lKI9k5ENOYDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 09:13:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<pymB9k5EJsx2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:15:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<+Lr4/E5Eoo4Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 24 09:15:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<4DyI/05EhsQDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-24 09:16:52 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:56993: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-24 09:16:59 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:53332: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.116.95
country_id: 3469034
description:
Nov 24 09:18:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=177.39.116.95, lip=66.85.158.91, TLS, session=</81aCE9ETraxJ3Rf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.46
country_id: 226074
description:
Nov 24 09:18:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.87.46, lip=66.85.158.91, TLS, session=<x06UCU9E1LjEAFcu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 24 09:20:25 host2 pure-ftpd[1103652]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 09:20:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<gpJSEE9EVJYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 09:20:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<idEMEk9E+Kwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 24 09:22:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<2m7cFk9ERNE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 09:22:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<4TQTGE9EqKI+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 09:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<uV0bGU9E0MfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 09:23:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+k/mG09EDOqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 09:23:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<8mAOGk9EuuA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 09:24:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<JoTZH09EfME+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.203.151
country_id: 1880251
description:
Nov 24 09:24:28 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.203.151, lip=66.85.158.92, session=<LKi0Hk9EoJGlmsuX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 09:24:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<QkkLH09EnOmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-24 09:25:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64107: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 09:26:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5acXJE9E+tMv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 09:27:06 host2 sshd[1108312]: Disconnected from invalid user  2.57.121.112 port 62727 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 24 09:26:32 host2 sshd[1107824]: Disconnected from invalid user minecraft 64.23.180.137 port 58888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.206
country_id: 6252001
description:
Nov 24 09:30:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<30PdMk9E19/G6xjO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 24 09:30:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<7HzIMk9E2KiSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 09:30:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<VrquNE9EzLov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 09:30:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ds30Mk9E6sZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.168.83.238
country_id: 2635167
description:
Nov 24 09:30:34 host2 sshd[1110891]: Disconnected from invalid user minecraft 81.168.83.238 port 35604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 09:31:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<h3wVN09E7pY+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 09:31:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<mfvGOE9E1okv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.168.83.238
country_id: 2635167
description:
Nov 24 09:32:38 host2 sshd[1112224]: Disconnected from invalid user stack 81.168.83.238 port 35884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 24 09:32:17 host2 sshd[1112058]: Disconnected from invalid user sonar 154.16.81.78 port 49938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 09:32:31 host2 sshd[1112162]: Disconnected from invalid user arnold 62.60.131.157 port 34416 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Nov 24 09:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, session=<6ZpLPk9EylBChJmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 09:33:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<NBcxQE9EuM4+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 24 09:33:14 host2 sshd[1112729]: Disconnected from invalid user vyos 64.227.102.57 port 44304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 24 09:36:03 host2 sshd[1114718]: Disconnected from invalid user media 154.16.81.78 port 46542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 09:35:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<pQaWRU9EBr4+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 24 09:35:39 host2 sshd[1114422]: Disconnected from invalid user stack 64.23.180.137 port 53436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.168.83.238
country_id: 2635167
description:
Nov 24 09:35:44 host2 sshd[1114470]: Disconnected from invalid user ghost 81.168.83.238 port 36308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 09:35:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<rbdiR09EkNc+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 24 09:36:50 host2 sshd[1115340]: Disconnected from invalid user minecraft 64.227.102.57 port 53194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 09:36:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<k8f3Sk9EZJEv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 09:36:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<fvkVSU9EohRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 09:36:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<CscaSU9EbI8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Nov 24 09:37:49 host2 sshd[1115932]: Disconnected from invalid user service 64.23.180.137 port 58318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 24 09:37:56 host2 sshd[1116036]: Disconnected from invalid user user1 64.227.102.57 port 33538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 24 09:37:15 host2 sshd[1115607]: Disconnected from invalid user stack 154.16.81.78 port 55282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 09:37:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YWTOTE9EIMZn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 24 09:39:02 host2 sshd[1116947]: Disconnected from invalid user ghost 64.227.102.57 port 47990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 09:38:16 host2 sshd[1116274]: Disconnected from invalid user user 2.57.121.25 port 48822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.16.81.78
country_id: 2077456
description:
Nov 24 09:39:37 host2 sshd[1117463]: Disconnected from invalid user a 154.16.81.78 port 44394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 09:39:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<kkBWU09E7LAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 09:40:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<SXK8WE9EmOM+PIOK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 24 09:40:09 host2 sshd[1118042]: Disconnected from invalid user uftp 64.227.102.57 port 54540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 09:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<pm4UV09EBrcFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 09:42:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<pCxgXU9EUrI+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.153
country_id: 6252001
description:
Nov 24 09:42:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.153, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gpdPYE9Epcai2JWZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 09:42:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<hUpuXk9EYLY+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 09:42:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<vmkCYE9Elp12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 09:43:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<WQSyYk9EXtSl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.153
country_id: 6252001
description:
Nov 24 09:43:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.153, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<68mTYU9EhOqi2JWZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.73
country_id: 298795
description:
Nov 24 09:45:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=95.0.171.73, lip=66.85.158.91, TLS, session=<7vTxaE9E36lfAKtJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.215.85
country_id: 3469034
description:
Nov 24 09:45:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.181.215.85, lip=66.85.158.91, TLS, session=<7DYaak9EvL4ttddV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Nov 24 09:47:32 host2 sshd[1123630]: Disconnected from invalid user manager 181.228.68.232 port 37040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 09:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zuDlb09EvqAv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov 24 09:48:35 host2 sshd[1124304]: Disconnected from invalid user devops 45.61.187.30 port 33248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.153
country_id: 6252001
description:
Nov 24 09:48:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.153, lip=66.85.158.92, TLS, session=<cZZbdU9EbP+i2JWZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.105
country_id: 798544
description:
Nov 24 09:48:47 host2 sshd[1124407]: Disconnected from invalid user deploy 83.168.78.105 port 48014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 09:49:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<6QXdeE9EKsQrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov 24 09:51:43 host2 sshd[1126177]: Disconnected from invalid user sistemas 45.61.187.30 port 37086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.228.68.232
country_id: 3865483
description:
Nov 24 09:51:38 host2 sshd[1126121]: Disconnected from invalid user tecnopos 181.228.68.232 port 49404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.105
country_id: 798544
description:
Nov 24 09:52:19 host2 sshd[1126595]: Disconnected from invalid user git 83.168.78.105 port 37566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 09:52:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+MVQgk9EYtmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 09:52:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<uFcYhE9EHqXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 09:53:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<jWQ6hU9EML4v+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Nov 24 09:53:14 host2 sshd[1127089]: Disconnected from invalid user huawei 181.228.68.232 port 50964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.105
country_id: 798544
description:
Nov 24 09:53:29 host2 sshd[1127231]: Disconnected from invalid user alice 83.168.78.105 port 48748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.105
country_id: 798544
description:
Nov 24 09:54:40 host2 sshd[1128541]: Disconnected from invalid user intell 83.168.78.105 port 58726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Nov 24 09:54:49 host2 sshd[1128595]: Disconnected from invalid user superadmin 181.228.68.232 port 52524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-11-24 09:55:14 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:56390: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-24 09:55:33 dovecot_login authenticator failed for ([187.51.219.26]) [187.51.219.26]:44537: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 09:56:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<IauPkk9ENJVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 09:57:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<vyghlk9E3owv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.96
country_id: 6252001
description:
Nov 24 09:57:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.96, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<usdTlk9E99bN0h9g>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov 24 09:58:00 host2 sshd[1130788]: Disconnected from invalid user vpn 45.61.187.30 port 34760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 09:58:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<SaBQmE9EJqQv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Nov 24 10:00:26 host2 sshd[1132622]: Disconnected from invalid user kali 45.61.187.30 port 33832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 10:00:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<efFmoE9E0IuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 10:02:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<JBG9p09EwocvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 10:03:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LVgOqk9EaiBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 10:04:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iMU5rk9EbOBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 10:04:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ybV9rk9EutA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 24 10:04:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<JsyKrk9EvoI+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 10:05:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<P/KXsU9EEIAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 10:07:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<v114uE9Eeo8+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 10:08:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<oMzOuk9Eyp0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 10:11:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<gILcxU9E7to+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 10:12:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<tkG4yE9E9Mk+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 10:13:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<X2KWzU9EQNMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 10:14:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<XdWb0U9Emts+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 10:15:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<v4U71U9EPpSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 24 10:16:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<CVnc2U9EYqo+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 10:18:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<iby04E9EhugrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 10:19:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<v3bw4U9ELqgv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 10:19:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ESrB4k9ETJiPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 10:21:49 host2 sshd[1148202]: Disconnected from invalid user admin 2.57.121.112 port 44446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 10:21:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<T2vu609EVMfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 10:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<B72q709EYpxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 10:23:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<1LW98k9EhIAv7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.16.55.198
country_id: 6252001
description:
Nov 24 10:25:05 host2 pure-ftpd[1150744]: (?@178.16.55.198) [INFO] New connection from 178.16.55.198


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 10:25:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ViAc+E9E3Ms+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 24 10:25:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<fkTD+E9EYos+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 10:26:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<MYL2+k9EXo0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 24 10:27:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<r30mAFBEQrs+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 10:28:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7T9sAlBEiM2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 10:28:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2jvaAlBEvChniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 10:28:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<l0jcBFBEmnEvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 10:31:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<B/7GDlBEUuln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 10:31:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</H7gDVBEZNwv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 10:34:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<d07cF1BE4IkI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-24 10:34:31 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:61493: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.108.86.59
country_id: 3469034
description:
Nov 24 10:34:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=187.108.86.59, lip=66.85.158.91, TLS, session=<U4f3GFBE/cO7bFY7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-24 10:34:57 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:59233: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.155
country_id: 798544
description:
Nov 24 10:35:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.125.244.155, lip=66.85.158.91, TLS, session=<KXMqGlBEeKBtffSb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 10:37:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<g58TIlBEnIgv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 24 10:38:38 host2 sshd[1159203]: Disconnected from invalid user admin 198.12.77.137 port 34294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Nov 24 10:38:41 host2 sshd[1159220]: Disconnected from invalid user tempuser 103.172.28.62 port 54690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 24 10:38:54 host2 sshd[1159344]: Disconnected from invalid user userroot 81.192.46.35 port 47170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Nov 24 10:39:17 host2 sshd[1159660]: Disconnected from invalid user admin 45.78.230.231 port 42986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Nov 24 10:39:51 host2 sshd[1160095]: Disconnected from invalid user sopuser 118.193.43.167 port 17992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Nov 24 10:41:09 host2 sshd[1161104]: Disconnected from invalid user tester 103.172.28.62 port 53412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Nov 24 10:41:16 host2 sshd[1161159]: Disconnected from invalid user user 118.193.43.167 port 46008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 24 10:41:46 host2 sshd[1161545]: Disconnected from invalid user max 81.192.46.35 port 55896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 24 10:41:55 host2 sshd[1161619]: Disconnected from invalid user qw 198.12.77.137 port 33408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Nov 24 10:42:35 host2 sshd[1162189]: Disconnected from invalid user mika 103.172.28.62 port 50364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Nov 24 10:42:56 host2 sshd[1162380]: Disconnected from invalid user ir 81.192.46.35 port 58282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 10:43:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<JtHfN1BEKrB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 10:42:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<lYFQNlBEHJIv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Nov 24 10:43:40 host2 sshd[1162880]: Disconnected from invalid user sahil 118.193.43.167 port 35532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 10:43:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ov5lOlBEINyPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 24 10:44:04 host2 sshd[1163298]: Disconnected from invalid user odoo 198.12.77.137 port 59502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 10:44:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<SX4VPFBENral6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Nov 24 10:44:52 host2 sshd[1163859]: Disconnected from invalid user sales1 118.193.43.167 port 62286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 24 10:45:12 host2 sshd[1164196]: Disconnected from invalid user max 198.12.77.137 port 41892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Nov 24 10:46:44 host2 sshd[1165713]: Disconnected from invalid user test1 103.172.28.62 port 52592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.18
country_id: 6252001
description:
Nov 24 10:47:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.18, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<I6pPSFBEKNisynYS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 10:47:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<X3xCSFBEttlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 10:48:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<dp9OSVBELJ4rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 10:48:04 host2 sshd[1166868]: Disconnected from invalid user clark 62.60.131.157 port 10233 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.81.33
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 42.191.81.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 10:50:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<L9WIUVBEqsgv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.28.62
country_id: 1210997
description:
Nov 24 10:50:42 host2 sshd[1168984]: Disconnected from invalid user guest 103.172.28.62 port 56044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 10:51:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ze07VFBEVo7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 10:52:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HZDPWFBEWTBniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Nov 24 10:53:28 host2 sshd[1171263]: Disconnected from invalid user odoo 45.78.230.231 port 43942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 24 10:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Ht+5XlBE2uQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 10:55:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vpa3ZFBEhrkvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.231
country_id: 1880251
description:
Nov 24 10:56:05 host2 sshd[1173909]: Disconnected from invalid user userroot 45.78.230.231 port 33502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 24 10:55:22 host2 sshd[1173462]: Disconnected from invalid user user 2.57.121.25 port 30507 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 24 10:55:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<iiVKZFBEgto+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 10:56:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ylLsZlBEZOE+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 10:56:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<A1hMaFBEgpuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 10:56:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<NY6qaFBEWsov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.132.129
country_id: 3469034
description:
Nov 24 10:58:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 33 secs): user=<info@weeratrading.com>, method=PLAIN, rip=191.53.132.129, lip=66.85.158.91, TLS, session=<6NKwbFBEqt6/NYSB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 10:58:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<hVJCb1BEjutn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.120
country_id: 953987
description:
Nov 24 10:58:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=102.64.40.120, lip=66.85.158.91, TLS, session=<osTPblBEDqVmQCh4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 11:00:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ZoLzdFBELuQI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 11:01:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<ziAfeFBERL4v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 11:06:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4xMkjFBESuov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 11:09:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ouxvlFBEEMWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 24 11:09:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<kiYBllBEdJY+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 24 11:09:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.150.152, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<W1Yhl1BEdsyi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 24 11:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<pO1TmlBELOWi2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 11:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jEA7mlBEItM+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 24 11:11:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=162.216.150.152, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<4DEpnVBEuP+i2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 11:13:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<0Jkgo1BEGLp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 11:12:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<rEeVolBE7MpA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 11:13:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<BOJhpFBEapSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 11:17:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<GOaWsVBELucv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 11:16:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<In+kr1BEUjhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 11:17:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<KQk5slBE9rQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 24 11:17:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.91, TLS, session=<nqZps1BEIvGi2JaY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.152
country_id: 6252001
description:
Nov 24 11:18:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.152, lip=66.85.158.91, TLS, session=<rdOntlBE/uai2JaY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 24 11:18:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<j5m4t1BElJo+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-24 11:20:49 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:50254: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-11-24 11:21:26 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:60668: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 11:21:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<asKbwlBEYLgv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 11:22:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<omKNxFBEjKQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 11:23:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<DYimyFBEZs7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 11:24:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<CUf0zFBEHt+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 11:25:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<s/pWz1BE1N9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 11:25:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<h5yD0FBEFtEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 11:25:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<SJG3zlBEYuAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 11:27:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mSVM2FBExp8+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 11:30:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wvOI31BEKNQv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 24 11:31:16 host2 sshd[1200847]: Disconnected from invalid user kasey 62.60.131.157 port 37977 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 24 11:31:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<UVxC5VBEnKk+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 24 11:32:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<eNNc51BEuNQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 11:33:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<E4w47FBEPJ6PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Nov 24 11:34:40 host2 sshd[1203092]: Disconnected from invalid user soporte 189.47.10.77 port 37038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 11:37:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+4vc+lBEOtlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 11:38:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<X2ik/VBEOJI+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 11:39:32 host2 sshd[1206886]: Disconnected from invalid user admin 2.57.121.112 port 57390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-24 11:39:42 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:39480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-24 11:39:58 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:44444: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 11:40:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nqoaBVFEDj5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 11:41:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<2+T3B1FEvM2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 11:42:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<+LszDVFE+sF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.8
country_id: 3175395
description:
Nov 24 11:42:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=185.15.171.8, lip=66.85.158.91, TLS, session=<qZD/DFFEAca5D6sI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.31
country_id: 953987
description:
Nov 24 11:43:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.39.31, lip=66.85.158.91, TLS, session=<jSMpDlFE7blmQCcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 11:43:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<2fu6D1FE8Mov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 11:44:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<NlVdFFFENpMFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 11:46:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<44pKGlFE3LkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 11:46:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<kxr4G1FEXqYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 11:48:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<b+6tIVFEyqQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 11:48:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<CIOyIlFE9IEvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 24 11:49:16 host2 sshd[1214046]: Disconnected from invalid user telecomadmin 2.57.121.112 port 62626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 24 11:50:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<DZOVKVFE6rw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 11:51:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ed5mLFFEwL0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 11:51:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<nt/MLFFESsmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 24 11:51:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<oY/aLVFE6s/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 11:52:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+vuDLlFEtNZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 11:53:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<V2xTNFFEHr4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 24 11:53:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<+loYNVFE6ME+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 24 11:57:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<ubSxQFFEKrs+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 24 11:58:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rUCvRFFEoOmPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Nov 24 11:59:54 host2 sshd[1222131]: Disconnected from invalid user qw 189.47.10.77 port 46918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 24 12:02:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7cN6UlFEcJdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-24 12:04:25 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:52486: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-24 12:04:34 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:59630: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 24 12:04:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<lOo0W1FEiUdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.20
country_id: 99237
description:
Nov 24 12:08:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=65.20.136.20, lip=66.85.158.91, TLS, session=<i6smZ1FEDrtBFIgU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 24 12:08:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GyiJaFFE5uql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.150
country_id: 3175395
description:
Nov 24 12:08:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.60.212.150, lip=66.85.158.91, TLS, session=<OdA9aFFE/sbCPNSW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 24 12:08:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Nu9DaVFEPuMv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 24 12:09:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<nORybVFE7tMFhH+s>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.77
country_id: 3469034
description:
Nov 24 12:10:24 host2 sshd[1230852]: Disconnected from invalid user hu 189.47.10.77 port 48762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 12:11:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Zaz5clFEUoM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 24 12:11:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<ShE4c1FEZtgv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 24 12:12:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<KqdWdlFEUJQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 24 12:12:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<bpandlFETJV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 24 12:12:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<f8pGeFFE7I8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 24 12:13:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<v6HDelFE3s8+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.42.99.144
country_id: 6252001
description:
Nov 24 12:13:31 host2 sshd[1233302]: Disconnected from invalid user autrede 20.42.99.144 port 36114 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 24 12:13:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LzGefFFEzrYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 24 12:15:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<I183gVFEyr0rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Nov 24 12:15:54 host2 sshd[1234892]: Disconnected from invalid user halo 118.193.39.127 port 59058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.130
country_id: 1819730
description:
Nov 24 12:16:13 host2 sshd[1235073]: Disconnected from invalid user free 101.36.109.130 port 38402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 24 12:18:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<4sbhi1FEwKgv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.42.99.144
country_id: 6252001
description:
Nov 24 12:17:16 host2 sshd[1235764]: Disconnected from invalid user desliga 20.42.99.144 port 42416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Nov 24 12:17:21 host2 sshd[1235832]: Disconnected from invalid user ubuntu 118.193.39.127 port 42458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 24 12:17:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<GJIZilFEZqkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 24 12:18:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8laii1FEwquWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 24 12:18:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<3kDgjVFE4vBChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.42.99.144
country_id: 6252001
description:
Nov 24 12:18:29 host2 sshd[1236627]: Disconnected from invalid user odoo17 20.42.99.144 port 35670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 24 12:18:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<A+cFjVFEMopn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 24 12:19:28 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=</fGRkFFEIuvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Nov 24 12:19:53 host2 sshd[1237573]: Disconnected from invalid user debianuser 118.193.39.127 port 33712 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Nov 24 12:19:27 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<s7d2kFFE/urPWvQc>


