# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 17:30:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xswRrS1Eqh0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 17:31:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<TS5Rry1EzuvIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 17:32:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<EnU8tS1ErMFn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 17:32:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7v3/tS1Eop1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 17:34:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ntU7uy1Eoq2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 17:35:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<bO32vy1EJJI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 22 17:37:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<d64mxS1EirySOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 17:37:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ww9xxi1ErI0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 17:37:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<J+egxi1EHtV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 17:37:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<3Q3exy1EZiJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 17:38:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<PXVkyC1EeIQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 17:38:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<lymmyi1ETKkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 17:39:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<+ETOzC1E7kmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 17:40:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GjR+zy1ECs2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 17:42:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<Q7eH1i1EljOYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-11-22 17:42:08 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:42718: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 17:42:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<F0/N1i1EmrII3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-22 17:42:31 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:34802: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 17:43:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<3QEh3S1EGp2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 17:44:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<8e9Z3S1ECt0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 17:43:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<n8+e2i1EzoQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 17:43:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<MgCN2y1ErJEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 17:45:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<RUVz4S1EaKMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 17:45:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<J1qU4y1E9Opn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.64
country_id: 3017382
description:
Nov 22 17:46:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.64, lip=66.85.158.91, session=<qkIs5y1EP5hbxJhA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Nov 22 17:46:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.67, lip=66.85.158.91, session=<W67J5y1EKehbxJhD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-22 17:47:27 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:33270: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-22 17:47:33 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:45335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 17:47:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<AlyC6i1E/IAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 17:47:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<TIXv6C1ErM6WXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.68
country_id: 3017382
description:
Nov 22 17:47:12 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.68, lip=66.85.158.91, session=<nPbt6C1EW7hbxJhE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.69
country_id: 3017382
description:
Nov 22 17:47:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.69, lip=66.85.158.91, session=<gogg6S1EVelbxJhF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 17:47:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<vaGi6S1EhJIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 17:49:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<kP468S1E9OMv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 17:49:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wkJX8i1Eeo7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 17:50:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<gom79S1EArkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 17:54:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<aINVAi5Egp0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 17:54:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<U/mJAi5EBoxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 17:54:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<7rJfAy5Ezr+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 17:55:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<beLLBC5E3pY+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 17:55:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<7inCBS5EAI1A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.137.74
country_id: 6252001
description:
Nov 22 17:55:47 host2 sshd[3581386]: Disconnected from invalid user p 159.89.137.74 port 45250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 17:56:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<E9KlCS5E0ql2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 17:58:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<RiqUEC5EkuM+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 17:58:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<RS/wES5EJNkv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 22 17:58:49 host2 sshd[3584623]: Disconnected from invalid user repo 45.169.200.254 port 60814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 17:58:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<c6XgEi5EEsQ+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.137.74
country_id: 6252001
description:
Nov 22 17:58:09 host2 sshd[3583864]: Disconnected from invalid user minecraft 159.89.137.74 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.137.74
country_id: 6252001
description:
Nov 22 17:59:17 host2 sshd[3585226]: Disconnected from invalid user frappe 159.89.137.74 port 44424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 17:59:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<M4dFFS5EbQhniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-22 18:00:04 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:45278: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.42.50
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.158.42.50 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 18:00:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<wTuKFy5E1EinYwhf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.217.243.90
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 102.217.243.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.249.153.7
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.249.153.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 18:00:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<mnHKGS5E+u6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 18:00:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gqbmFi5EdqkzTY0d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.133.133
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.128.133.133 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.224.176
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.45.224.176 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 18:01:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<6CExGi5E9MQ+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-22 18:00:21 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:59204: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.216.140.226
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.216.140.226 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.150.132.66
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.150.132.66 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 18:01:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pY5VGy5Ehqil6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.137.74
country_id: 6252001
description:
Nov 22 18:02:54 host2 sshd[3588864]: Disconnected from invalid user backup 159.89.137.74 port 55636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 18:02:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<hv9eHi5EcqsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 18:02:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<o8G8Hy5EMow+PIcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Nov 22 18:03:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YKdbJC5E2vNChJlz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 18:04:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</6iMJi5EBIgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 18:04:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<G6FuKC5ELMII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 18:05:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<lEFVKy5ErJwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 18:06:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<26wxLC5EzqQI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 18:06:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<d27gLC5EHsSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 18:06:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<WLQKLS5EEIkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 18:06:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lI6tLS5ENuEEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 18:07:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<s6koMS5Erptn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 18:09:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+HUkOC5Epq6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 18:10:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<W2pEOy5EyLfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 18:10:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<zuZjOy5E7Igv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 18:11:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<b8QxPi5ECv0vTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 22 18:11:51 host2 sshd[3597134]: Disconnected from invalid user abcd 45.169.200.254 port 46392 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Nov 22 18:14:43 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, TLS, session=<FfheSy5EpuNC5DUE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 18:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zI3tSy5ECp+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 18:15:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<2ApiTS5E+L92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 18:16:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<mUn0Ty5E1Nhn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.229.45
country_id: 1269750
description:
2025-11-22 18:16:39 dovecot_plain authenticator failed for (DESKTOP-GAVQ8IE.domain.name) [122.169.229.45]:53163: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 18:18:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<ixfyVy5EOLQ+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 18:19:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<eWmmWi5Eqqk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 18:18:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<KdymVy5ETKNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 18:19:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<njj5Wi5EspsFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 18:19:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<WknwXC5EutWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 18:19:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<B0DoWy5E5Lw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 18:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<PQRRXS5Eyusv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 18:21:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<FzsLYy5ECNQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 18:21:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<sD51Yy5EDBFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 18:21:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<cYCGYy5EAJmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 18:21:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<7N12ZC5ErKkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 18:22:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<OfwAaC5EYMul6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-22 18:23:10 dovecot_plain authenticator failed for (acers) [76.190.155.43]:33308: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.229.45
country_id: 1269750
description:
2025-11-22 18:24:00 dovecot_plain authenticator failed for (DESKTOP-GAVQ8IE.domain.name) [122.169.229.45]:63393: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.229.45
country_id: 1269750
description:
2025-11-22 18:24:06 dovecot_login authenticator failed for (DESKTOP-GAVQ8IE.domain.name) [122.169.229.45]:63393: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 18:24:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<gNNxbS5EqIM+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 18:24:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Q7qHbi5EtIUv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 18:25:54 host2 sshd[3605935]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 18:25:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<JF3xcC5EEL4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 18:25:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<qJ0wcS5EQu4v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.229.146.97
country_id: 6251999
description:
Nov 22 18:25:59 host2 sshd[3605958]: Disconnected from invalid user p 4.229.146.97 port 54494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 18:26:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<sAfydC5E2Jcv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 18:26:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<SB2BdS5EEIYI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-11-22 18:28:45 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:49118: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 18:28:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<xxHbfS5EzOSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 18:28:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<s7Erfi5ESNXIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-22 18:29:10 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:55102: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 18:29:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Ne6Kfy5EyINn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 18:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<T44Ygi5EVpcI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.229.146.97
country_id: 6251999
description:
Nov 22 18:30:10 host2 sshd[3608355]: Disconnected from invalid user rustserver 4.229.146.97 port 51784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 18:31:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6RVAhy5E9LuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 18:31:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<eVoNhi5Egp4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 18:31:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<WLtEhi5Erq0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 18:34:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<yktOki5ElJ0+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 18:34:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<CNiUki5EWLJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 18:35:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<KHQwlS5EVs+PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.229.146.97
country_id: 6251999
description:
Nov 22 18:36:15 host2 sshd[3612303]: Disconnected from invalid user zy 4.229.146.97 port 42344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 18:37:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Fg8wni5Ejopn9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.93.227
country_id: 6252001
description:
Nov 22 18:38:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.93.227, lip=66.85.158.92, session=<VpfHni5ECrUv+13j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 18:38:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<rCWWoC5E3LqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 18:39:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<tisrpC5E+ts+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.229.146.97
country_id: 6251999
description:
Nov 22 18:40:22 host2 sshd[3614712]: Disconnected from invalid user alberto 4.229.146.97 port 35052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 18:40:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<OqPIpy5EsIorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 18:40:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<FcSbqC5EWoxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 18:40:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<ErLbqC5EXJYv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-22 18:41:21 dovecot_login authenticator failed for ([46.149.83.62]) [46.149.83.62]:44380: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 18:41:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<uMutqi5EhM4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-22 18:41:29 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:36918: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 18:42:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FoNiry5EACOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 18:43:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<DQgTsy5E3KkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 18:43:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<TnDZsy5E0Nk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 18:44:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<4hr7sy5EoLQEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 18:43:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<7hc2sS5E0q0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 18:43:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WS49si5E3Bdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 18:44:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Dwt+tC5ExpGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 18:44:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Ov9dtS5EAuQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 18:44:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<A7/StS5EEtEv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Nov 22 18:46:23 host2 sshd[3619319]: Disconnected from invalid user steam 45.78.203.166 port 57858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 18:46:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<6sQTvi5EApIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 18:46:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<4XWTvi5E4KU+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 18:47:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<H/g5vy5ERus+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 18:47:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<4SStwS5EFszIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 18:47:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<O7PYwS5ESLMI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Nov 22 18:49:23 host2 sshd[3621334]: Disconnected from invalid user steam 5.198.176.28 port 44048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Nov 22 18:50:35 host2 sshd[3622336]: Disconnected from invalid user odoo 5.198.176.28 port 44146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 18:50:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<VrlezC5E1pqUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 18:51:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<UzrpzS5E3nsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 18:51:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<lsAkzi5EHqFn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Nov 22 18:51:29 host2 sshd[3622901]: Disconnected from invalid user mdm 45.78.203.166 port 60950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 18:51:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<8l2Pzy5EVLEv+yXY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 18:54:44 host2 sshd[3625098]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 18:54:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<USWH2C5EoqeWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 18:54:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Cyex2C5E8K52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 18:54:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<o7wb2S5EhO0+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 18:54:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<YLpL2S5EuokI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 18:55:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<s5US3C5EqrWPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Nov 22 18:55:24 host2 sshd[3625714]: Disconnected from invalid user cso 5.198.176.28 port 44558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Nov 22 18:56:33 host2 sshd[3626596]: Disconnected from invalid user ftpuser 5.198.176.28 port 44656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 18:57:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<AaFr5C5ErqKYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Nov 22 18:58:58 host2 sshd[3627992]: Disconnected from invalid user red 45.78.203.166 port 40812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 18:59:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<tPYm6i5Eru1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 18:59:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<8ghV6y5E7II+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 18:59:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<lGff7C5EorMrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 19:00:32 host2 sshd[3629064]: Disconnected from invalid user cydney 62.60.131.157 port 28070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 19:01:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<pAq48C5E0LYv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Nov 22 19:01:24 host2 sshd[3629510]: Disconnected from invalid user cso 45.78.203.166 port 53248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 19:02:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<v9oK9i5ETq5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 19:02:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<tPdX9i5ESos+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 19:02:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<X4dz9y5EHtsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 19:03:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ifPq9y5EduCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 19:03:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<BUGZ+S5Ektov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 19:03:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<x7tL+y5EWJQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 19:04:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<whNY/S5EYo4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 19:05:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TS7uAS9EryFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 19:05:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<qZtaAS9ESoCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 19:05:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Vgd4AS9EEqozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 19:06:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<CnRuBS9EbrzIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 19:06:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xvuoBS9E7owv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 19:07:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<Z7BfCS9EjIQFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 19:08:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<dGsBDS9EwOMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 19:11:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<YQt9Fi9EQlIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 19:12:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<QQ0nGC9EdsUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 19:13:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<vdbqHi9Eprt2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 19:14:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<GxqSIi9EvpiPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.141.91.94
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.141.91.94 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.32.38.125
country_id: 1668284
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 114.32.38.125 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.17.43.206
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.17.43.206 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 19:16:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<4gqbJy9E2o4+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 19:16:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<arbEKC9E1IqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 19:16:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<5zwIKS9EYoqYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.82.71
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.206.82.71 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 19:17:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Qo7WKy9EEtI+PIcg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.85.5.217
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.85.5.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 19:18:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<D90IMS9EluoI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 19:19:17 host2 sshd[3640603]: Disconnected from invalid user admin 2.57.121.112 port 39575 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 19:19:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<PohPMi9EEN0rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 22 19:21:05 host2 sshd[3641666]: Disconnected from invalid user test 135.235.138.43 port 55972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 19:20:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<y1zQNS9EDMhn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 19:21:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<WkuROy9E/u0EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 19:21:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<tSSROS9EsqUv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 22 19:22:59 host2 sshd[3642647]: Disconnected from invalid user sasan 186.64.123.41 port 56459 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 19:22:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TZ56Pi9EMtEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 19:23:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KaMvQS9EQm+nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 22 19:24:51 host2 sshd[3643598]: Disconnected from invalid user zhangy 135.235.138.43 port 38720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.143.125.172
country_id: 2658434
description:
Nov 22 19:24:17 host2 sshd[3643328]: Disconnected from invalid user seekcy 157.143.125.172 port 59980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 19:24:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qdiYRC9EDKtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 19:24:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<hUPZRS9Eqtwv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 22 19:25:19 host2 sshd[3644013]: Disconnected from invalid user steam 134.122.121.56 port 46388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 19:25:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<i8o2SS9EgK3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 19:26:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<TLwsTS9ENocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 19:28:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EtFcUS9E4ilniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 19:27:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<xVe1Ti9E6JCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 19:27:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<NlMOUC9ELqozTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 22 19:27:45 host2 sshd[3645249]: Disconnected from invalid user ravi 135.235.138.43 port 33676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.143.125.172
country_id: 2658434
description:
Nov 22 19:28:25 host2 sshd[3645691]: Disconnected from invalid user test 157.143.125.172 port 62426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 22 19:29:32 host2 sshd[3646182]: Disconnected from invalid user vlad 186.64.123.41 port 53991 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 19:29:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<xE33Vy9EjKUI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 19:30:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58091: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.235.138.43
country_id: 1269750
description:
Nov 22 19:31:09 host2 sshd[3647278]: Disconnected from invalid user minecraft 135.235.138.43 port 48170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 19:32:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<YZG2Xy9ERi0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 19:32:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<HfiKYC9ETNov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 19:33:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<dQGHZC9EouN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 19:33:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<bGpuZS9EuMZn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.143.125.172
country_id: 2658434
description:
Nov 22 19:34:02 host2 sshd[3648737]: Disconnected from invalid user snort 157.143.125.172 port 60361 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 19:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<QZpHZC9EBrk+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 22 19:34:25 host2 sshd[3648959]: Disconnected from invalid user postgres 134.122.121.56 port 39566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 19:34:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<gdiIaC9ELpmUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 19:34:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<G9UaaS9EiuaPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 22 19:34:46 host2 sshd[3649139]: Disconnected from invalid user user1 186.64.123.41 port 43558 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.210.40.38
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 102.210.40.38 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 19:35:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<xd8/bC9EDOw+PIcq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.125.69.141
country_id: 630336
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.125.69.141 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.109.214
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.181.109.214 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 19:35:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<3u7ZbC9EgHKYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.216.119.97
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.216.119.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.88.134
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 60.50.88.134 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.223.109.196
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.223.109.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.231.137.55
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.231.137.55 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.143.125.172
country_id: 2658434
description:
Nov 22 19:37:20 host2 sshd[3650763]: Disconnected from invalid user ubuntu 157.143.125.172 port 60495 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 22 19:38:13 host2 sshd[3651258]: Disconnected from invalid user jack 186.64.123.41 port 46007 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 19:38:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<bHzXdy9EEpgrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 19:39:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<HEagei9EzN8+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 22 19:39:51 host2 sshd[3652383]: Disconnected from invalid user sysadm 134.122.121.56 port 60444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 19:39:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Fu9ieS9E7rmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 19:41:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<WMjgfy9EOLcEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 19:42:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<4D2Qgy9EZIcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 19:41:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Qpc/gS9EbJRn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 22 19:41:37 host2 sshd[3653588]: Disconnected from invalid user vlad 134.122.121.56 port 37868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 19:42:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</IBZgy9E4scv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 19:42:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<nU+lhC9EJMs+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 19:42:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<8nHihC9EVto+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 19:43:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<vXkwiS9E6twI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.121.56
country_id: 6252001
description:
Nov 22 19:43:29 host2 sshd[3654698]: Disconnected from invalid user jack 134.122.121.56 port 53508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 19:44:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WAn2iy9Eej6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 19:44:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<eHBljS9ErMLIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 22 19:45:16 host2 sshd[3656474]: Disconnected from invalid user gitlab 34.58.124.191 port 52960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 19:45:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<H3b3ji9Ewqsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 19:46:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<t8Mzky9ETqg+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 22 19:46:32 host2 sshd[3657317]: Disconnected from invalid user sammy 34.58.124.191 port 36076 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 19:46:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<r49wlC9E4KlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 19:46:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q9gylS9EKoAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 19:48:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<1hSimS9EQIU+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 19:48:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<timAmy9Ewos+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 19:49:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<6++DnC9ESq6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 19:49:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<lIj/ni9EXqozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 19:50:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Ul4yoS9Ezp8+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 19:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yOFUoS9EJzJniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 22 19:50:25 host2 sshd[3659747]: Disconnected from invalid user gitea 34.58.124.191 port 34444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 19:50:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<m95Moy9E2tUI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 22 19:51:42 host2 sshd[3660443]: Disconnected from invalid user saeed 34.58.124.191 port 34602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-11-22 19:52:18 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (bicaterm) [24.23.125.83]:60410: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.190.74
country_id: 6252001
description:
Nov 22 19:52:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.190.74, lip=66.85.158.91, session=<VSqjqC9ENo4tT75K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 19:52:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<flhDqS9EuM8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 19:52:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<M7meqS9EvO0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 19:52:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<EQajqi9EuNF2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.190.74
country_id: 6252001
description:
Nov 22 19:53:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.79.190.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<jkCcqy9EFr8tT75K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 19:53:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9WwPrS9EPqZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 19:54:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Xcbvry9EtN2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 19:54:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gAfbsC9EuFqYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.190.74
country_id: 6252001
description:
Nov 22 19:55:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.79.190.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<JckntC9EtsgtT75K>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.228
country_id: 6252001
description:
Nov 22 19:56:50 host2 pure-ftpd[3664538]: (?@195.184.76.228) [INFO] New connection from 195.184.76.228


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 19:56:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<VkLuuC9ELJ2UcQQF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.231
country_id: 6252001
description:
Nov 22 19:56:50 host2 pure-ftpd[3664536]: (?@195.184.76.231) [INFO] New connection from 195.184.76.231


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 19:58:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Xd/svC9EHsErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 20:00:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<EuEMxC9ElOMEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 20:01:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<JOhTyi9EWJqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 20:01:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ISEwyC9E9L4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 20:01:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<7yqKyS9E5OE+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 20:02:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<9DolzS9E6qZn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Nov 22 20:03:31 host2 sshd[3668766]: Disconnected from invalid user rundeck 34.85.163.94 port 38942 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 20:03:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<CcPP0S9E3tjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 20:03:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<kWtYzy9EvJAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 20:03:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<QVUa0C9ESrY+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-22 20:04:50 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:42819: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-11-22 20:05:21 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:33250: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 20:05:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<5wQt2C9EZsQv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-22 20:05:45 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:61670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 20:05:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Cazt2C9ECHenYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.85.163.94
country_id: 6252001
description:
Nov 22 20:06:25 host2 sshd[3670638]: Disconnected from invalid user group1 34.85.163.94 port 39482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 20:07:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<OhpR3S9EPOYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 20:08:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<y7g54S9EbM8I3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-22 20:08:45 dovecot_plain authenticator failed for (undial) [65.20.174.63]:50885: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Nov 22 20:09:27 host2 sshd[3672303]: Disconnected from invalid user ec2-user 85.206.171.113 port 51138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 20:09:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cCfE5S9E8IxA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 22 20:10:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sDAD6S9Epsq4affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 20:10:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<5aDh6i9EFpml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 20:12:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<8Gvc7i9EsJMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 20:12:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<RGX87i9ElKozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 20:13:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<EVN78i9EWowv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 20:12:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eJAI8S9E9Tlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 20:12:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<NKou8S9EZth2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 20:13:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rBWq8i9EBn4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 20:13:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<eHCN9C9ETIdn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 20:13:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<L6ps9S9EhD+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 20:14:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<hTaO9i9EIMyPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Nov 22 20:15:16 host2 sshd[3676193]: Disconnected from invalid user john 85.206.171.113 port 44872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 20:17:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<9EhjAjBEWuYrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Nov 22 20:17:32 host2 sshd[3677432]: Disconnected from invalid user p 85.206.171.113 port 44796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Nov 22 20:17:15 host2 sshd[3677335]: Disconnected from invalid user deployer 104.248.245.89 port 44224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Nov 22 20:18:17 host2 sshd[3677843]: Disconnected from invalid user ahmed 104.248.245.89 port 46926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 20:18:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<PXAOBzBEetQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 20:19:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<yncwCDBELLwEkXBg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Nov 22 20:19:41 host2 sshd[3678500]: Disconnected from invalid user admin 85.206.171.113 port 58854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 20:19:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<D0zSCjBENuiUcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Nov 22 20:20:28 host2 sshd[3679296]: Disconnected from invalid user p 104.248.245.89 port 42390 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 20:20:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<X0TsDTBE3rQv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.241.231.2
country_id: 6252001
description:
Nov 22 20:21:44 host2 sshd[3680250]: Disconnected from invalid user work 128.241.231.2 port 22644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov 22 20:21:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.92, session=<LNpIEjBE8q6UccFP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 22 20:23:17 host2 sshd[3681416]: Disconnected from invalid user ja 93.113.63.124 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Nov 22 20:23:27 host2 sshd[3681512]: Disconnected from invalid user me 101.47.48.72 port 55184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 20:23:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<uQf1GDBEarVn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 20:23:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<R1mrFjBECLrIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.119.137
country_id: 1522867
description:
Nov 22 20:24:52 host2 sshd[3682489]: Disconnected from invalid user homeassistant 45.8.119.137 port 38396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.238
country_id: 3469034
description:
Nov 22 20:25:04 host2 sshd[3682749]: Disconnected from invalid user test 186.209.77.238 port 41353 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 20:24:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1BHeGjBEKOIv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.241.231.2
country_id: 6252001
description:
Nov 22 20:24:33 host2 sshd[3682291]: Disconnected from invalid user tesoreria 128.241.231.2 port 2574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 20:24:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7YDPGzBEVIqWXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.241.231.2
country_id: 6252001
description:
Nov 22 20:25:42 host2 sshd[3683362]: Disconnected from invalid user itt 128.241.231.2 port 41164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov 22 20:26:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RVtvIjBEjtpBMQHo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.241.231.2
country_id: 6252001
description:
Nov 22 20:26:52 host2 sshd[3684245]: Disconnected from invalid user bit 128.241.231.2 port 16812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 20:27:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<mOJaJDBE5t8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 20:26:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<EgE1IjBEFM0v7bxd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.94.106.87
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.94.106.87 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.163.115.221
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 78.163.115.221 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.116.184
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.20.116.184 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.137
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.78.137 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov 22 20:27:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7xc3JTBEIFzY2s5E>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.15.155
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.181.15.155 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.241.231.2
country_id: 6252001
description:
Nov 22 20:28:06 host2 sshd[3685268]: Disconnected from invalid user mark 128.241.231.2 port 35530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 20:27:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XO6DJTBEBLOnYwhf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.96.255.206
country_id: 2782113
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.96.255.206 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.236.59.221
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.236.59.221 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 22 20:28:37 host2 sshd[3685660]: Disconnected from invalid user hesam 93.113.63.124 port 44974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.90.248
country_id: 6251999
description:
Nov 22 20:28:47 host2 sshd[3685757]: Disconnected from invalid user itt 4.206.90.248 port 58184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Nov 22 20:29:51 host2 sshd[3686273]: Disconnected from invalid user ftpuser 93.113.63.124 port 48932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov 22 20:30:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.99, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WR9mMDBENdwjy9Nj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 22 20:30:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.208.45, lip=66.85.158.91, TLS: Connection closed, session=<vfPlMTBEzsiUcdAt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 22 20:31:00 host2 sshd[3686981]: Disconnected from invalid user misha 93.113.63.124 port 51556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.238
country_id: 3469034
description:
Nov 22 20:31:40 host2 sshd[3687341]: Disconnected from invalid user ll 186.209.77.238 port 45629 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 20:32:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<aXshNzBEhN5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 20:32:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<4xF7NzBEsud2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 20:33:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<3swGOjBEoMMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 20:33:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<c84vOjBEdiiYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Nov 22 20:32:10 host2 sshd[3687589]: Disconnected from invalid user hesam 101.47.48.72 port 35898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.90.248
country_id: 6251999
description:
Nov 22 20:32:54 host2 sshd[3688045]: Disconnected from invalid user dev 4.206.90.248 port 47090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 20:33:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<KDPaOTBE5sGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 20:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<OfvTOjBEvqEv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 20:33:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9GJPOzBEyMEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 20:33:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<rUryOzBEdKVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 20:33:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<cvCvPDBEHJyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 20:33:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<iUzEPDBEjuwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 20:34:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<K2tWPzBEyKozTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Nov 22 20:34:48 host2 sshd[3688944]: Disconnected from invalid user mark 101.47.48.72 port 56872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 20:34:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<746JQDBEBEJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 22 20:35:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<hDMkRDBE/pE+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.209.77.238
country_id: 3469034
description:
Nov 22 20:36:41 host2 sshd[3690278]: Disconnected from invalid user ubuntu 186.209.77.238 port 34742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 20:36:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<oFeuRzBEZKErpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.99
country_id: 2635167
description:
Nov 22 20:37:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.99, lip=66.85.158.91, TLS, session=<VmWFSDBEau8jy9Nj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 20:38:22 host2 sshd[3691501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 20:38:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<8WQlTDBE1qQEkXBg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.209.77.238
country_id: 3469034
description:
Nov 22 20:38:15 host2 sshd[3691421]: Disconnected from invalid user me 186.209.77.238 port 49921 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.90.248
country_id: 6251999
description:
Nov 22 20:39:12 host2 sshd[3692035]: Disconnected from invalid user factorio 4.206.90.248 port 33032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 20:40:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<CvBBUzBEIKwv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.206.90.248
country_id: 6251999
description:
Nov 22 20:41:15 host2 sshd[3693395]: Disconnected from invalid user ubuntu 4.206.90.248 port 34806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 20:42:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<5rnrWjBEeJrIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 20:42:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<raoDWzBE2JuUcQQF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.78
country_id: 6252001
description:
Nov 22 20:43:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.78, lip=66.85.158.92, session=<hGcsYDBEa7hAPsVO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 22 20:43:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS: Connection closed, session=<S1jmYDBEsjtAPsVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 20:43:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<SxvmYDBE/Lc+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 22 20:44:07 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, session=<xHmeYTBE5BVAPsVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 20:44:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<rpEsZDBEwtxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 20:45:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<253/ZTBEVOYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 20:46:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VDGlazBEbNkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 20:47:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<iNzuazBEeskv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 20:47:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<EfnnbTBE/NmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 20:48:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<6usNcjBEVkenYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 20:48:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jncPcjBEqoA+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 20:50:16 host2 sshd[3699455]: Disconnected from invalid user admin 2.57.121.112 port 27719 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 20:50:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<voyqdzBEos8+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Nov 22 20:50:32 host2 sshd[3699632]: Disconnected from invalid user work 101.47.48.72 port 44190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 20:52:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6IyvfTBEMtx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 20:52:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gdsvfzBEPOiYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 20:53:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<PpbngjBEHrUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 20:53:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<qmIWgzBEHM4+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 20:53:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<OrSSgzBE+t2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 20:53:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<AKdRhDBEqKRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 20:54:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<+KFdhTBEvoUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 20:54:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<cfDJhTBETPsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 20:54:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Sc7ghzBEJMZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 20:55:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<IF5QiTBEEJOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 20:56:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<pLrkjTBElssrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 20:57:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<9KaCkDBE9qozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 20:57:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3VhikDBEXOQEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 20:57:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<q49OkDBElkZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 20:58:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<ZfbTlTBEWLQI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 20:59:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<4qAtlzBENro+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 20:59:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GAGJmTBEvqIv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.117.156
country_id: 1269750
description:
Nov 22 21:00:01 host2 sshd[3706032]: Disconnected from invalid user stage 4.213.117.156 port 44412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.72
country_id: 1880251
description:
Nov 22 21:00:53 host2 sshd[3706682]: Disconnected from invalid user ftpuser 101.47.48.72 port 60080 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 21:01:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ABHMnzBEOOLIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Nov 22 21:01:25 host2 sshd[3707136]: Disconnected from invalid user ubuntu 89.126.208.241 port 46402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Nov 22 21:03:48 host2 sshd[3708938]: Disconnected from invalid user tes 89.126.208.241 port 57548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.127.232
country_id: 6252001
description:
Nov 22 21:03:58 host2 sshd[3709129]: Disconnected from invalid user dev 209.46.127.232 port 32580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.117.156
country_id: 1269750
description:
Nov 22 21:04:31 host2 sshd[3709424]: Disconnected from invalid user celery 4.213.117.156 port 54502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 21:04:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<s8WWqzBEur6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 21:06:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<sjfrrzBEzLxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 21:06:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<86EasTBEtqMv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.127.232
country_id: 6252001
description:
Nov 22 21:06:34 host2 sshd[3710741]: Disconnected from invalid user alma 209.46.127.232 port 59236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 21:06:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zj0/szBEjJo+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 21:07:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<asx4szBEvtIv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 21:07:19 host2 sshd[3711124]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.117.156
country_id: 1269750
description:
Nov 22 21:07:33 host2 sshd[3711359]: Disconnected from invalid user deployer 4.213.117.156 port 32876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 21:07:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<IPnitTBEHrw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 21:08:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<KhgEtzBE/t4+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 21:07:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ToyBtDBEfIEv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 22 21:07:59 host2 sshd[3711690]: Disconnected from invalid user minecraft 103.172.20.218 port 41444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 21:08:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<goFCuTBEtsk+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 22 21:09:23 host2 sshd[3712455]: Disconnected from invalid user maurice 103.172.20.218 port 53368 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 21:09:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<YfVBvDBESNQ+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 21:10:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<GDQ0wDBEkL6WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 21:10:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WYXdvjBEhsinYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Nov 22 21:10:14 host2 sshd[3713183]: Disconnected from invalid user dev 89.126.208.241 port 54236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.46.127.232
country_id: 6252001
description:
Nov 22 21:10:23 host2 sshd[3713326]: Disconnected from invalid user leonard 209.46.127.232 port 39676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.117.156
country_id: 1269750
description:
Nov 22 21:10:34 host2 sshd[3713429]: Disconnected from invalid user edi 4.213.117.156 port 35150 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 108.67.198.176
country_id: 6252001
description:
Nov 22 21:10:41 host2 pure-ftpd[3713575]: (?@108.67.198.176) [INFO] New connection from 108.67.198.176


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 22 21:10:45 host2 sshd[3713598]: Disconnected from invalid user ec2-user 103.172.20.218 port 53200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 21:10:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<rs6ewTBEqKc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 21:11:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<InAVxTBEmuE+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 21:11:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<cm7UwzBEUNGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 21:11:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ZtITxDBETMx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 21:13:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<+OLnyjBEQscv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 21:13:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<xNgryzBEyr+PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.117.156
country_id: 1269750
description:
Nov 22 21:13:59 host2 sshd[3715950]: Disconnected from invalid user ci 4.213.117.156 port 39164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 21:14:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wLSUzzBE7NBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 21:15:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<A1Ra0DBE0lcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 21:15:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<o1x50DBE3LUI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-22 21:15:51 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:45614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-22 21:16:16 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:63858: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 21:16:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<brqt1DBEeJ4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 21:16:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<5EPA1DBE5IcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 21:17:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<VtIX2TBEXNel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 21:17:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<iBw+2jBEisc+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 21:17:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<z30N2DBEBJpA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 21:19:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UnJN4DBEuwhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 21:19:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<JDrA4TBEGqszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 21:19:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<2F8F4DBErJkv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 21:20:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<+uKP5DBEuq3IMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov 22 21:21:48 host2 sshd[3720960]: Disconnected from invalid user admin 103.172.20.218 port 34026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 21:22:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<dowI6zBEVKM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 21:24:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<nklb8DBE0KYI3ocK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 22 21:23:18 host2 pure-ftpd[3721746]: (?@64.62.156.192) [INFO] New connection from 64.62.156.192


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 21:25:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<p+hl9DBE/LE+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-22 21:28:01 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:53696: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 21:27:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<EZcb/DBEDNpn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 21:27:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<MDEe/DBEZrsv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-22 21:27:40 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:52163: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 21:27:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<mtDl/TBEqNsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 21:27:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<IRdK+zBEbtqUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 21:27:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DMq8+zBEnssv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 21:30:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<gQ1vCDFEvrmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 21:31:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<8NXpCjFEytV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 21:31:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ycn8CjFE3O+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 21:32:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<yYmuDjFEtqo+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 21:32:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<bHLkDzFEltk+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 21:33:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<UPPCEzFEktgv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Nov 22 21:33:40 host2 sshd[3728125]: Disconnected from invalid user mihail 23.95.37.90 port 46802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 21:33:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<+FLWEjFE9tuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 21:33:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<aGjXEjFE2qKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 21:34:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<QNRvFzFE/roFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 21:35:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<JwhuGTFE/p4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 21:36:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<dJ1KHDFErLIrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Nov 22 21:36:30 host2 sshd[3730184]: Disconnected from invalid user lwd 103.123.53.88 port 47734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Nov 22 21:36:43 host2 sshd[3730313]: Disconnected from invalid user ubuntu 81.192.46.49 port 47926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-22 21:36:59 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:41010: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 21:36:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1WulGzFEdMkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 21:36:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<iYbYGzFE8OQI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 21:36:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<S2rBHDFEvqRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 22 21:37:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<BJmxHzFETOs+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 22 21:37:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<QijEITFE4sI+PIOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Nov 22 21:38:38 host2 sshd[3731557]: Disconnected from invalid user ec2-user 103.123.53.88 port 34352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 21:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<sG1YJTFEIJAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 21:38:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<QxLaIjFEvM8+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 21:39:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<uNPJKDFEtIfIMGRT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.37.90
country_id: 6252001
description:
Nov 22 21:40:02 host2 sshd[3733280]: Disconnected from invalid user amanda 23.95.37.90 port 58572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 21:39:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uiYOKDFEApNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 21:39:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JR1ZKDFE+uml6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.170.31
country_id: 3865483
description:
2025-11-22 21:41:42 dovecot_plain authenticator failed for ([31.57.166.48]) [186.158.170.31]:33088: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.155.207.171
country_id: 3469034
description:
2025-11-22 21:41:57 dovecot_plain authenticator failed for ([31.57.166.48]) [177.155.207.171]:29803: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 21:42:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<TObLMDFEEBFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Nov 22 21:41:21 host2 sshd[3746054]: Disconnected from invalid user runcloud 103.123.53.88 port 32818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.229.62.65
country_id: 2464461
description:
2025-11-22 21:41:26 dovecot_plain authenticator failed for ([31.57.166.48]) [196.229.62.65]:39188: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 21:42:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<chCSMTFEPKszTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Nov 22 21:42:21 host2 sshd[3746922]: Disconnected from invalid user leonardo 23.95.37.90 port 58588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Nov 22 21:42:38 host2 sshd[3747034]: Disconnected from invalid user tms 103.123.53.88 port 34126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Nov 22 21:43:05 host2 sshd[3747355]: Disconnected from invalid user mosquitto 81.192.46.49 port 47470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 22 21:43:34 host2 sshd[3747737]: Disconnected from invalid user aa 102.211.209.191 port 37032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.49
country_id: 2542007
description:
Nov 22 21:44:13 host2 sshd[3748213]: Disconnected from invalid user test 81.192.46.49 port 46492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Nov 22 21:44:38 host2 sshd[3748437]: Disconnected from invalid user test 38.47.94.55 port 57524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 22 21:44:52 host2 sshd[3748543]: Disconnected from invalid user ec2-user 102.211.209.191 port 34278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 22 21:45:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<b1YoPDFEZtQ+PIco>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 22 21:46:04 host2 sshd[3750033]: Disconnected from invalid user git 102.211.209.191 port 37976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Nov 22 21:46:07 host2 sshd[3750050]: Disconnected from invalid user ftpuser 38.47.94.55 port 37506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 22 21:45:10 host2 sshd[3748938]: Disconnected from invalid user test1 109.205.114.34 port 49688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 22 21:46:30 host2 sshd[3750262]: Disconnected from invalid user aa 109.205.114.34 port 36342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 21:48:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<XGUtRjFEtuIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 21:48:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<AE0xRjFEGtU+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 22 21:47:13 host2 sshd[3750736]: Disconnected from invalid user seal 102.211.209.191 port 51392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 21:47:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<zvzfQzFENMUv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Nov 22 21:47:29 host2 sshd[3750881]: Disconnected from invalid user pwserver 38.47.94.55 port 47992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.205.114.34
country_id: 99237
description:
Nov 22 21:47:46 host2 sshd[3750999]: Disconnected from invalid user p 109.205.114.34 port 52684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 21:48:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<ttnFSDFE4sJn9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Nov 22 21:48:49 host2 sshd[3751546]: Disconnected from invalid user p 38.47.94.55 port 41292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 21:49:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<tq2PSTFEqMCUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-22 21:49:04 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:34212: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 21:48:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<EzasRjFEwNsv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 21:49:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<p4E7SjFE3p+YIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-11-22 21:49:23 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:1558: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 21:49:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<q3RxSzFEMJkI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 21:50:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<OF2vTzFEguh2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Nov 22 21:50:12 host2 sshd[3752459]: Disconnected from invalid user eis 38.47.94.55 port 49820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.108.165
country_id: 99237
description:
2025-11-22 21:52:04 dovecot_plain authenticator failed for ([31.57.166.48]) [185.181.108.165]:50878: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Nov 22 21:51:55 host2 sshd[3753389]: Disconnected from invalid user pwserver 102.211.209.191 port 46810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.108.165
country_id: 99237
description:
2025-11-22 21:52:12 dovecot_login authenticator failed for ([31.57.166.48]) [185.181.108.165]:50878: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.7.43.179
country_id: 6252001
description:
2025-11-22 21:52:16 dovecot_plain authenticator failed for pool-108-7-43-179.bstnma.fios.verizon.net ([31.57.166.48]) [108.7.43.179]:54811: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.180.18
country_id: 3469034
description:
2025-11-22 21:52:30 dovecot_plain authenticator failed for ([31.57.166.48]) [179.48.180.18]:12180: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 21:52:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<G9FkVjFEQp+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 21:52:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<YPzAVjFEVJuPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 22 21:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XZiBWzFEooZChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 21:54:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ZL4tXTFEOIAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 21:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<78EuXzFElIsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 21:56:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<0bd8ZDFEWN4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 21:56:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<29gLZjFEtteWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 21:57:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<t8oAaDFEqoUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 21:57:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<EhAAaDFEAKcI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 21:57:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rOyFaDFE3L0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 21:57:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EeHzaDFErOhn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.189
country_id: 6252001
description:
Nov 22 21:58:30 host2 pure-ftpd[3757578]: (?@147.185.132.189) [INFO] New connection from 147.185.132.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.190.42.243
country_id: 298795
description:
2025-11-22 21:58:57 dovecot_plain authenticator failed for ([89.116.164.85]) [78.190.42.243]:32136: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 21:58:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<88KTajFEDN/IMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-22 21:59:17 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:53500: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-22 21:59:58 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:52896: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 22:00:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<L6gkdDFE8pKl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 22:02:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<sXN0eDFEvrVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 22:03:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<141VfjFEeKszTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.131
country_id: 1643084
description:
Nov 22 22:03:51 host2 sshd[3761141]: Disconnected from invalid user asd 103.171.85.131 port 55952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 22:04:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<iVqKgDFEBtY+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 22:04:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wh0SgjFEvhlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 22:07:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<u498izFEuoWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 22:07:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<djWMjDFEGsAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 22:07:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<r3T9jDFEyJM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 22:07:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<I7gxjTFEjsov7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Nov 22 22:08:43 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.92, session=</CcykDFE2K2UcdOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 22:08:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</5i9kDFEeoI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 22:09:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<PPhAkzFEBOx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 22:10:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<7AjRlDFEeN+UcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.131
country_id: 1643084
description:
Nov 22 22:10:07 host2 sshd[3765401]: Disconnected from invalid user ftpuser 103.171.85.131 port 54660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 22:09:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1YK4kTFEgLQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 22:09:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<qBHTkTFE0sg+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.104
country_id: 6252001
description:
Nov 22 22:10:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.104, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aY57lTFE0VhAPpxo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 22:10:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<LDRilTFEKOdn9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.94
country_id: 6252001
description:
Nov 22 22:10:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.94, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I1iNljFE0IlAPpxe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 22:11:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qIy+mTFEdNaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 22 22:12:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<POQDnDFElKY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 22:12:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<wWuvnTFEoMk+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 22:13:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<JPaBojFECtunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 22:14:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<BlqLpDFEMpEEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 22:14:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<VqMwpjFE8JUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 22:15:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<cH0KqTFEhIsI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 22:16:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<DamPrDFEwJsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 22:16:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<R4HQrDFEjs3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 22:16:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8CyfrTFEcuov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 22:18:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<emE3tDFE9tcI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 22:19:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Ing/tTFEErhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 22:18:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9v1JszFETvUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 22 22:20:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<CS6cuDFE5r0+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 22:20:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<OSL8ujFEJJmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.250.132.204
country_id: 2542007
description:
2025-11-22 22:21:21 dovecot_plain authenticator failed for ([31.57.166.48]) [41.250.132.204]:56642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.141.63
country_id: 3469034
description:
2025-11-22 22:21:33 dovecot_plain authenticator failed for ([31.57.166.48]) [190.89.141.63]:28954: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-22 22:21:49 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:54835: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.196.74.131
country_id: 298795
description:
2025-11-22 22:21:08 dovecot_plain authenticator failed for ([31.57.166.48]) [46.196.74.131]:57694: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-22 22:21:16 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45150: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 22 22:23:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<VherwzFEALiSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 22:23:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<6pOqxTFEopCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 22:24:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<lLhixzFErpAFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 22:24:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<plXcyTFE/tJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 22:25:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<rqsOzDFEsKszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 22:25:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<TjqHzDFEXGuYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.165.84
country_id: 6252001
description:
Nov 22 22:26:30 host2 pure-ftpd[3775454]: (?@34.224.165.84) [INFO] New connection from 34.224.165.84


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 22:27:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<heel0zFEYoYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 22:27:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3ROJ1DFEkrkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 22:27:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<61/b0jFEYyFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 22:28:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ClpO1jFEZr92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 22:30:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<pnhR3TFEutEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 22:30:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TPep3DFEGs+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 22:31:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<fhdy4TFEdOyUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 22:31:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<VozI4TFEWN5n9Sd0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:33:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<i9l86jFEKN8jy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 22:33:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<v50z6TFEnOcEkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 22:34:40 host2 sshd[3780080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 22 22:34:46 host2 sshd[3780098]: Disconnected from invalid user admin 2.57.121.112 port 40794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:35:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<O5hj7jFEkvAjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov 22 22:35:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.92, session=<1sUR8TFEDrHY2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 22:35:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FFl47zFERG2nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 22:35:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<O9N27zFE6Kgv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<8fOw7zFEFukjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 22 22:35:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=</Bmj8DFEtvpBMRRE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 22:35:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<eq7K8DFEjLzIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov 22 22:36:17 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.92, session=<VjDO8jFE+HTY2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 22 22:36:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<apG88jFERKPF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 22 22:36:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Ic8V8zFEjoA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 22:36:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nQhu9DFETscrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 22:36:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<nxmU9DFEHOAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 22 22:37:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<rUU29zFEwqA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 22:39:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<QbXD/TFE3IM+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 22:39:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<e0zG/jFExkIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 22:40:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ZSIaATJEzJoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 22:40:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tHkFATJECodn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 22:42:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<G0OIBzJEAuwI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 22 22:42:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS, session=<y0oTCDJEqPcjy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 22:44:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7wTqDjJEBlKYIMkL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.173
country_id: 6252001
description:
Nov 22 22:44:59 host2 pure-ftpd[3786443]: (?@198.235.24.173) [INFO] New connection from 198.235.24.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 22:45:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<W0jmETJEssmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 22:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<zbZNFzJExIWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 22:48:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<iaHRHDJE8JRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 22:47:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<H9j5GTJETsw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 22:47:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<bJSIGjJEUrp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 22:47:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<q2SmGjJEMpIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 22:47:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<+TN1GzJE6qszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 22:47:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3JZSHDJEcLMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 22:47:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Ujd2HDJEyMQ+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-22 22:49:12 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:39696: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-11-22 22:49:17 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (jetous) [72.241.202.104]:39667: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 22:49:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FsIMIjJE8oyPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-22 22:49:46 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:39964: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 22:50:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RAIOJDJElypniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-22 22:50:15 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:50578: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 22:51:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<bKJSKTJEmJYv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 22:52:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<lnZCKzJE5qBn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-22 22:52:25 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43421: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-22 22:52:43 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:53148: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 22:53:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<TKqJLjJEgowEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.210.123.17
country_id: 1819730
description:
Nov 22 22:52:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.210.123.17, lip=66.85.158.91, session=<seT/KzJEgJYI0nsR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 22:53:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<ly4KLzJExLGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 22:56:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<860/OTJECr4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 22:55:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rDJkNzJExMDIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 22:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<mvFsODJEUIc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 22:56:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Q9BHOzJEQM8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 22:56:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lE6yPDJEHF+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 22:57:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<lvQmPTJEZoUrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.254.207
country_id: 99237
description:
2025-11-22 22:58:24 dovecot_plain authenticator failed for ([31.57.166.48]) [62.201.254.207]:14450: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.189.181.36
country_id: 3996063
description:
2025-11-22 22:58:35 dovecot_plain authenticator failed for fixed-187-189-181-36.totalplay.net ([31.57.166.48]) [187.189.181.36]:54596: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.206.185
country_id: 99237
description:
2025-11-22 22:58:46 dovecot_plain authenticator failed for ([31.57.166.48]) [185.187.206.185]:22186: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:00:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<W+umSTJE1KkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<x6DASzJE0phn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.88
country_id: 3017382
description:
Nov 22 23:01:19 host2 pure-ftpd[3797562]: (?@91.196.152.88) [INFO] New connection from 91.196.152.88


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 22 23:01:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<wlI9TTJEthVChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:01:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ERzITTJEJMwI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 22 23:03:27 host2 sshd[3799017]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:04:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=</pTKVTJEKD2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 23:03:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<2YCpVDJEbo0+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:05:13 host2 sshd[3800159]: Disconnected from invalid user ubuntu 202.70.82.95 port 63722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:06:47 host2 sshd[3801059]: Disconnected from invalid user rta 202.70.82.95 port 12918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 23:08:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<R6Q/ZDJEut4I3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:07:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<7fpaYTJEpLh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:08:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<K9R+ZDJEtq0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:08:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LRYHZTJEfMwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:08:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=</c2gZzJEvo2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:09:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Ut4WajJENsWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:09:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<3B3QajJE9LaPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-11-22 23:12:05 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (chess) [174.58.87.108]:44386: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:11:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<G8x/bzJEBKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:12:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<u/dMdTJEsTJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:13:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zuH2dTJEjNAv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<HqWwczJEApJn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:12:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<eKM0dDJEdpUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:13:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Q5fNeDJEELhA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Nov 22 23:14:05 host2 sshd[3805326]: Disconnected from invalid user deployment 202.70.82.95 port 36400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:14:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<z37sfDJExs7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 23:15:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<P/qwfzJECMk+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 23:15:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<mPIwgDJEAsiUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:16:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<rKvUgjJEHNQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:16:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<gU0bgjJE4r4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:17:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<M/2fhTJEnLErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 23:18:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XmqXiTJEQDmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:21:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<I2oYlDJEPKsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 22 23:22:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<9CGOmDJE3rA+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:22:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kwWJmTJEuL9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:23:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<oUdDmjJEKI8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:23:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<hTxjnDJE9ieYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-22 23:24:23 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:59150: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-22 23:24:47 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:41568: 535 Incorrect authentication data (set_id=parentscoignard111)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.135.168.245
country_id: 6252001
description:
Nov 22 23:25:51 host2 pure-ftpd[3812506]: (?@43.135.168.245) [INFO] New connection from 43.135.168.245


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.226.252
country_id: 1668284
description:
Nov 22 23:26:01 host2 pure-ftpd[3812630]: (?@165.154.226.252) [INFO] New connection from 165.154.226.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.199
country_id: 2635167
description:
Nov 22 23:26:26 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.199, lip=66.85.158.91, session=<NXgbpjJEmvYjy9LH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:27:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<iETUqDJEwKR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 22 23:27:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XSEFqjJEVtQ+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:28:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</UEcrzJEqIAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:29:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<MwKRrzJESNQ+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:28:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Oi5ErDJE8qcv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-22 23:28:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61444: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qswEszJEKOKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 22 23:29:36 host2 sshd[3814530]: Disconnected from invalid user clifford 62.60.131.157 port 23504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:32:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ZAEEujJE5KUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:32:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<p0gXvDJE6Ltn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:32:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uLzDvDJErMql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:33:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<0VJ8vTJE/ruWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 22 23:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<TGLwwTJEINEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:34:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wtGiwjJEcurIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov 22 23:34:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, TLS: Connection closed, session=<iaLPwzJEYqeUcdL+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:34:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<QFpewjJEtokv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-11-22 23:34:24 dovecot_plain authenticator failed for (watomitasm) [192.81.229.179]:38326: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 22 23:34:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xWs9wzJEyrw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:34:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<j+3pwzJEIqwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:35:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<x6NixjJEKzxniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:36:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<GgNPyDJEiK4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:36:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<S1t+yjJEeolA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:37:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<ANMpzjJE7N0rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 22 23:38:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<blp/zzJELJ8FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:37:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JOhAzDJE7Okv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-11-22 23:37:22 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (squittis) [73.197.194.98]:45964: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 22 23:38:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<Jx6h0TJEbuaUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 22 23:40:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<yKTN1jJEKnGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 22 23:42:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Pdv33TJERiwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 22 23:42:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=</1z94DJEvoU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 22 23:43:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QGeE4jJEJumYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 22 23:44:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<3zVM5jJEAJNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 22 23:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P5Pc5jJENr8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 22 23:47:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QKId8DJEeN52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 22 23:48:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yGHn9DJESqIv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-22 23:49:20 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (bicticacia) [73.224.171.101]:46640: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 22 23:49:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<tzKL+TJE1uUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 22 23:50:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EfC/+zJEot6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 22 23:51:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3eiNADNEOIIEkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-11-22 23:52:29 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:40456: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-22 23:52:49 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:34057: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 22 23:53:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Lo0XBTNETLRn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-22 23:52:12 dovecot_plain authenticator failed for (zationak) [92.62.243.174]:59189: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 22 23:54:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<FmjYCDNEvtHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:53:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8MgRBzNEjLs+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.57.26
country_id: 6252001
description:
Nov 22 23:54:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.57.26, lip=66.85.158.92, session=<GYtOCTNEauoU3Tka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 22 23:54:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<wPNnCjNE5sc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 22 23:55:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<u2DFDjNEho0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 22 23:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<xoTzDjNEtJwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 22 23:56:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<KuLuETNE4ro+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 22 23:57:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<QPqgEzNE7sY+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 22 23:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<9i1jEDNEXrGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 22 23:58:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jr06FzNEJpwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 22 23:57:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8W0/FDNEft2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 22 23:57:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LgBbFDNEPoA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 22 23:57:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<CnbUFTNEco8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 22 23:58:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<LJQ/GTNEbKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 22 23:58:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<e7OIFzNE1URniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 22 23:59:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1iwdHDNEyqRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:01:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<NdowJDNEMGunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 23 00:01:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<pezKIjNEfM2UcQQF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.9
country_id: 6252001
description:
Nov 23 00:01:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.9, lip=66.85.158.91, session=<jCjFIzNEyMwUQcIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:02:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<spVfKDNEvK8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 00:02:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<Uq+tKDNEfMEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:03:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<rxRHKTNE+tOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 00:05:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<YqTgMTNEXu0+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:06:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Q2rcNDNEBMVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 00:06:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<0wccNjNEkOY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1442NDNE+oEI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-11-23 00:07:23 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:37868: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.23
country_id: 3017382
description:
2025-11-23 00:07:52 dovecot_login authenticator failed for ([188.231.3.23]) [188.231.3.23]:34397: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:07:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<EZqbNzNEkuh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:08:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xiYhPjNEZpYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 00:09:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Ck+rPjNEuL8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:10:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NY5XRDNERJsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:10:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<7579RDNEaJ6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:11:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<I9FiRzNEKNsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:14:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<8ayeUDNEZr3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:14:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<3NjGUjNEwN1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:15:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ozMQVjNEpoQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 00:17:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<TGgdXDNENrMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:18:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<obA7YDNEksgrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 00:18:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<3FoVYTNEGp4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 00:19:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Giy7ZDNEiMGl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 00:21:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<xgdvaTNEjkxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 00:21:15 host2 sshd[3847192]: Disconnected from invalid user admin 2.57.121.112 port 48283 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 00:22:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<bEL3bDNEDJ2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 00:22:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<KV3sbjNE5ONA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 00:23:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gMpWcDNEoKwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:23:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<+cpacDNE8r6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:23:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<+1HycjNEYkwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:23:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<C6XUcjNEClinYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:24:55 host2 sshd[3849437]: Disconnected from invalid user noc 156.245.239.180 port 37008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 00:25:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<0eE3eDNEvKE+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:25:38 host2 sshd[3850284]: Disconnected from invalid user tony 130.107.240.11 port 39194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 00:26:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<+vyNfTNEvp4+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:27:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<gJBbfzNEtq52wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:27:20 host2 sshd[3851136]: Disconnected from invalid user cod 156.245.239.180 port 43996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:27:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<7GvcgTNEeLMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:28:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kB4sgjNEPr5n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:28:06 host2 sshd[3851557]: Disconnected from invalid user p 130.107.240.11 port 32866 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 00:30:03 host2 sshd[3852850]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:29:25 host2 sshd[3852310]: Disconnected from invalid user cpd 130.107.240.11 port 55186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:29:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FVlHiDNExogv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:29:48 host2 sshd[3852564]: Disconnected from invalid user p 156.245.239.180 port 49712 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 23 00:30:49 host2 sshd[3853445]: Disconnected from invalid user frappe 130.107.240.11 port 44592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 23 00:31:02 host2 sshd[3853577]: Disconnected from invalid user ftpuser 156.245.239.180 port 37082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 00:31:07 host2 sshd[3853597]: Disconnected from invalid user zx 45.151.183.142 port 45964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:31:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<6/HojTNEpIwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:31:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<oiFrjjNENN+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:31:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<2icrjzNE1OAv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:32:21 host2 sshd[3854228]: Disconnected from invalid user p 185.216.119.134 port 60812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:32:27 host2 sshd[3854256]: Disconnected from invalid user temp 190.117.52.211 port 50272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:33:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<vW5QlzNEnOLIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:33:58 host2 sshd[3855102]: Disconnected from invalid user vpn 190.117.52.211 port 51378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 00:35:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<xZ61nDNEYKwI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:35:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<o/n0nDNEltov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:36:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Bgx4oTNEhJJn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:36:59 host2 sshd[3857028]: Disconnected from invalid user ubuntu 190.117.52.211 port 58252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:37:03 host2 sshd[3857095]: Disconnected from invalid user ftpuser 185.216.119.134 port 35280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 00:36:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<SlBcoDNEBNs+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Nov 23 00:38:20 host2 sshd[3857881]: Disconnected from invalid user vncuser 185.216.119.134 port 34348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:38:28 host2 sshd[3857944]: Disconnected from invalid user n 190.117.52.211 port 38774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:38:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Kb3zqDNE0oYrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 00:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<QiUJqTNEkqMv+3xn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Nov 23 00:39:35 host2 pure-ftpd[3858590]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 00:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Am+rqzNEaKwv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 00:40:16 host2 sshd[3859357]: Disconnected from invalid user hello 45.151.183.142 port 34542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Nov 23 00:41:36 host2 sshd[3860214]: Disconnected from invalid user zx 190.117.52.211 port 37540 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.112
country_id: 6252001
description:
Nov 23 00:42:30 host2 pure-ftpd[3860751]: (?@198.235.24.112) [INFO] New connection from 198.235.24.112


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:42:33 host2 sshd[3860777]: Disconnected from invalid user test1 103.250.11.235 port 53616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 00:42:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<GcsftzNEets+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 00:42:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<tFKptzNEgKqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 00:43:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<BBkFujNEErql6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov 23 00:43:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XLzSujNE6MPG6xgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 00:44:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<XpNwuzNEhghniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:44:04 host2 sshd[3861564]: Disconnected from invalid user tom 103.250.11.235 port 46106 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 00:43:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<A8bFuTNEJuo+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 00:44:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<dolWvTNExr0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 00:45:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WICvwDNEHO+nYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.235
country_id: 1643084
description:
Nov 23 00:45:31 host2 sshd[3862880]: Disconnected from invalid user ftpuser2 103.250.11.235 port 47494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 00:45:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+G0CwjNEEtNA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Nov 23 00:45:20 host2 sshd[3862828]: Disconnected from invalid user production 118.194.230.231 port 47032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Nov 23 00:46:49 host2 sshd[3863857]: Disconnected from invalid user kamal 118.194.230.231 port 47152 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 00:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<147bxjNEQoyWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 00:47:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<QvEvxzNEVN92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 00:47:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<LIkVyTNE0KwzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:48:39 host2 sshd[3864937]: Disconnected from invalid user datacom 64.227.170.15 port 36592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 00:49:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<JXW0zzNEGOUI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:49:56 host2 sshd[3865584]: Disconnected from invalid user xiaolin 64.227.170.15 port 59104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 00:49:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<eBeo0DNEIORn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 00:50:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<dIKG0TNEGrM+PIcq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:50:15 host2 pure-ftpd[3866004]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 00:50:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7qg40jNECukv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 00:51:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<AJuJ1DNEsMsEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 00:52:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<c6hE2DNElN2PbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:51:11 host2 sshd[3866668]: Disconnected from invalid user titu 64.227.170.15 port 51030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 00:52:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<n3nI2TNEJIwv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.170.15
country_id: 1269750
description:
Nov 23 00:53:37 host2 sshd[3867998]: Disconnected from invalid user adeel 64.227.170.15 port 56090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 00:53:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<xToA3jNEbLTIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:53:51 host2 sshd[3868125]: Disconnected from invalid user nikhil 57.128.173.133 port 45970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 00:54:51 host2 sshd[3869256]: Disconnected from invalid user syed 62.60.131.157 port 15785 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:55:51 host2 pure-ftpd[3870019]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:55:51 host2 sshd[3870012]: Disconnected from invalid user saka 57.128.173.133 port 57980 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 00:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</mvs4zNE/sIv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:55:46 host2 pure-ftpd[3869966]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:56:41 host2 pure-ftpd[3870470]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Nov 23 00:56:44 host2 pure-ftpd[3870495]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-11-23 00:57:54 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:54346: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:58:04 host2 sshd[3871420]: Disconnected from invalid user noc 57.128.173.133 port 37466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-11-23 00:57:37 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:33610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 00:57:50 host2 sshd[3871240]: Disconnected from invalid user ftproot 85.133.237.178 port 38342 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 00:58:28 host2 sshd[3871707]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 00:58:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<i0O68DNEwsNn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 00:59:02 host2 sshd[3872107]: Disconnected from invalid user deepak 85.133.237.178 port 35712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.173.133
country_id: 3017382
description:
Nov 23 00:59:04 host2 sshd[3872166]: Disconnected from invalid user ec2-user 57.128.173.133 port 48140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 00:59:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<cOEY8jNEprMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:00:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<Rg929jNE6scv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:00:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<f2UD9zNEDLsv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 01:01:40 host2 sshd[3873818]: Disconnected from invalid user nikhil 85.133.237.178 port 47046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 01:02:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<L4Q5/DNEypg+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:03:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<airO/zNE0JaYIMkL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.178
country_id: 130758
description:
Nov 23 01:04:22 host2 sshd[3876130]: Disconnected from invalid user foundry 85.133.237.178 port 49494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 01:05:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<RsBMBzREAqo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:05:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<WmE+CDRENkgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:07:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ChfiDTREhBRniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.183.142
country_id: 2635167
description:
Nov 23 01:07:10 host2 sshd[3877793]: Disconnected from invalid user ec2-user 45.151.183.142 port 45796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:07:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Wn0pDzRE/NKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:07:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<GhZ8DzRE0rOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:07:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<CtzZDzREfup2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Nov 23 01:07:39 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, session=<F3UhEDREjtes6yiD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:09:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YQYZFTRETsVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 01:08:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<4jbiEjREVJcI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:10:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ryfiGzRE4uwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:11:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qvBMHjREEMRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 01:11:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<AzBRHjRE4IU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:11:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Xc/nHjRERqgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:11:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xyhIHTREftsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 01:11:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<SVwBHjRE5I4+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 01:12:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6TvWIDRE6MuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 23 01:12:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<qNwVIjRECK0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 01:12:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<aEQtIjRECpQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:12:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qdXUIjRELpePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:13:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ehE8JTREvKnIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:13:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<llmmJTREtJ8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:15:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<5ZYiLDREpqov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-23 01:16:38 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:35730: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 01:16:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<u0ceMDREUsU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 01:16:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<RpL3MDREUJQ+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 01:17:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ct0UMjRE6NY+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.133
country_id: 1269750
description:
2025-11-23 01:17:17 dovecot_login authenticator failed for erpump.tcil.in [1.7.83.133]:41832: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 01:20:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<9sSjPDREwOErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 01:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<sOS2QDREHOBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:21:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<4PfnQjREKsov+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:22:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<gKiBRDRE+OMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:23:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<aN3rSDREDoSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:26:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<h9qDVDREaI8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-23 01:27:45 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (hylograke) [73.213.236.66]:49064: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:28:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<SrsiWjREptZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:29:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<JKy+XTRERNOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-23 01:29:40 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (nomalis) [80.14.31.158]:58329: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 01:29:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<TzvGXjRE5oQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:30:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tQD+YDRE8R1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:31:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<DqGjZDREuuAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:31:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<NhTxZjREgNql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:32:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0unHaDRE7swv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:32:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<whQHaTREOIZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 01:33:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<qoQQbDRE2t6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<QTLUbTREvNsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<B0HUbTRE+Mxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4SbMbTREOqWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:33:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<tvAObjRE7onIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 01:33:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<HoOgazREQMQ+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:35:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<LOJAcjREKtwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:36:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8EG0dTRE0pIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 01:37:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<I29qeTREApSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-23 01:37:42 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (derapice) [24.91.103.202]:41836: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.70
country_id: 6252001
description:
Nov 23 01:38:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.29.23.70, lip=66.85.158.91, session=<m2ZKfjREvqEUHRdG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-23 01:38:58 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:37018: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-11-23 01:40:04 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:33217: 535 Incorrect authentication data (set_id=monnierbenoitmichel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 01:41:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<nUufhzRE7qErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 01:41:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<yJcKiDREQoII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 01:43:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<dBzSjjREwtUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 01:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<LEKCjzREitNn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 01:43:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<6cipkTREFnGYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:44:46 host2 sshd[3900405]: Disconnected from invalid user bbx 123.58.212.133 port 58880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 01:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<NcT/kzREPM0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 01:47:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<46dknjREpME+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:47:25 host2 sshd[3902255]: Disconnected from invalid user staging 123.58.212.133 port 59254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:48:36 host2 sshd[3902902]: Disconnected from invalid user qa 123.58.212.133 port 57166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 01:49:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<V23ZozREKq52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 01:48:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<mwV3oTREfn4vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2025-11-23 01:50:28 dovecot_login authenticator failed for ([5.11.162.163]) [5.11.162.163]:46046: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-23 01:50:48 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:47604: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Nov 23 01:50:59 host2 sshd[3904389]: Disconnected from invalid user eric 123.58.212.133 port 42300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 01:51:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<1m3erDREPNKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 01:51:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lSHjrDREKr4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 01:53:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oS61szRE0iRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 01:53:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1skqszRE1L4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 01:54:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<Wx59tjREopjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 01:54:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<FJPItzREVNSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 01:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jrwmvDRE4sVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 01:55:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P4cSvDREdqAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 01:56:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<swiGvzRE4Jkv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 01:56:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<VtRpvTRERqRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 01:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<fC6QvTRE4ugv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 01:56:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nu4LvjRE1sql6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.52
country_id: 6252001
description:
Nov 23 01:57:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.52, lip=66.85.158.92, session=<hOiWwTREbuoUqWk0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-23 02:00:52 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:59524: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-11-23 02:01:09 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:43024: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:01:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<gdpP0DREyJiWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 02:01:39 host2 sshd[3911429]: Disconnected from invalid user kaci 62.60.131.157 port 34938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:01:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jC5l0TREZs8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:04:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7afj2TREnl2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<JnId2jRE2t8v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:05:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<o9IV3zREkr5n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:06:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<z5rQ4jREfrYv+3xn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:08:06 host2 sshd[3915299]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 02:07:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZLWS5jREtLs+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 02:08:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<QMok6zREmuw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:09:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<B6Od7DRENqZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:09:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fD+t7TRE4m4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:11:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<51Vx9DREAJYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:13:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FCF6/DRE3penYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 02:13:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<U6Q6/TREUNsI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:14:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xfJw/TREKLAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 02:14:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<x4nS/TRELJ0+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:14:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<3wfn/zREksXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:15:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pdxVATVEMrGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-23 02:15:31 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:57421: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-23 02:15:47 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:55336: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 02:16:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<5drDBTVErC5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:16:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<znn1BTVEKtEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:17:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<qlTrCTVE4NII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 02:17:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<zF1YCzVE0JDF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 02:17:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<NC55CzVEFOJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 02:18:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<SP1yDDVEnp4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 02:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<1Q/yETVEfIBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 02:20:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<dbRPEzVE9uE+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:20:23 host2 sshd[3923275]: Disconnected from invalid user user1 161.132.50.17 port 47740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 02:20:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<EeaRFTVEjril6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:22:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<MgUyGzVEao4rpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:24:20 host2 sshd[3925330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 02:23:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<pdxWIDVEjuo+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:24:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<e58ZIjVE+EmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:24:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<y9j+IzVETuov+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:25:48 host2 sshd[3926605]: Disconnected from invalid user admin 161.132.50.17 port 47892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:26:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<iKdHKDVE3paWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 02:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<MVfxKjVEeNs+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:27:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<7Hv9LDVEFI5n9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:28:21 host2 sshd[3928176]: Disconnected from invalid user ec2-user 161.132.50.17 port 57382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:28:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1ihwMTVECJIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:29:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<otwBNTVEbL12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:30:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yldYOTVEwCMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:31:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3ZbzOzVE4LwEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:32:16 host2 sshd[3930842]: Disconnected from invalid user henry 161.132.50.17 port 41142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 02:32:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<jjwoPzVE7us+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.199
country_id: 6252001
description:
Nov 23 02:33:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.199, lip=66.85.158.91, TLS, session=<XjRtQzVECvTN0h/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ECazRTVEzJov+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 02:34:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<M6cPRjVEjKA+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.50.17
country_id: 3932488
description:
Nov 23 02:34:52 host2 sshd[3932374]: Disconnected from invalid user git 161.132.50.17 port 54336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:35:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<EFBeSDVEmMjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:35:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BCumSDVEOqePbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 02:35:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<zEdMSTVEEs4+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 23 02:35:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<GGL2STVEKJKLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:35:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<w16bSzVEngSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:36:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cBksTjVEoLgv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Nov 23 02:37:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.82, lip=66.85.158.92, TLS, session=<X/+bUDVEkv3G6xhS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:38:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Jp6lVTVENJUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 02:38:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VWu0VTVEVzZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 02:39:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mv4EWTVEgJw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 02:39:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<FDqkWTVEXOZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 02:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<aevNWDVE5uwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:42:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<G2IhZDVESt0+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 02:43:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<APsCZTVE+LsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 02:43:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<a5CfZTVERsY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 02:43:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xYz7ZTVEpshA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:44:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zF2BajVEyNY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 02:44:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<nlecajVE3jaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 02:45:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<6pE2bTVEIIAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 02:45:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<0/pObTVECsWl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 02:46:09 host2 sshd[3939812]: Disconnected from invalid user admin 2.57.121.112 port 14954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 02:46:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+XM3cjVEaMYI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 02:48:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<s6QeejVE2LBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 02:49:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<59rPfTVEOrV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 02:50:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<LsMsgDVEQOcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 02:50:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<dqJcgDVE0oOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 02:52:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BrY+hTVErrUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 02:51:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wTchgzVEmMcEkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 02:52:33 host2 sshd[3943342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 02:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<SqUSkDVEXOKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 02:54:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<dlRujjVEeIQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 02:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<GhuajzVEooTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 02:56:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TqAEljVEYqAv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 02:57:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<2sU+mjVERtg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 02:58:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<of49mzVEWmSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 02:59:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<tuz+njVEUNk+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 02:59:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<QbCvoTVESsYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 03:01:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<mi4WpjVExqY+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:01:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eWkApjVESjVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:00:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<+GYbpTVESqYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:01:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<euqzpjVEfI5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-23 03:03:03 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:54040: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:03:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vMjsrTVEoOgrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-23 03:03:34 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:39438: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:04:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<zYKnsjVEKvqYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:05:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<4GKktjVEiIUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:07:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<dG44uzVEnNZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 03:07:23 host2 sshd[3952779]: Disconnected from invalid user admin 2.57.121.112 port 54659 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:10:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wPypxjVECrd2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:09:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<UD8VxDVEtKyl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-11-23 03:10:08 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:49736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 23 03:10:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<RThHxzVEeu1n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:11:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<yuG+yTVEdqcEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 23 03:11:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=</Qy5yjVElcAtQ5ts>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.246
country_id: 953987
description:
Nov 23 03:12:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.41.246, lip=66.85.158.91, TLS, session=<LqHeyzVEH7BmQCn2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:12:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<KmT2zjVEEokv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:13:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<91Be0DVErsovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:14:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<2bJP1zVEBt0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:15:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BHqf1zVEXMqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 03:15:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7ivg1zVEtrSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<h0kn1zVEMLPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:16:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<cX/L3TVE/ocv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-11-23 03:17:16 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:52388: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-23 03:17:52 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:57565: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 03:18:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<xBpD4jVELuOSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 03:18:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<huc45TVEjMY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 03:19:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<dsHd5zVERrEI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 03:19:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<hbRD6TVEQrc+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 03:20:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<i/Jk6zVEmAunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:21:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<yAmu7TVEJNUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 03:21:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Uh827zVEMOMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:22:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<J6du8zVEjtxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:23:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nYuY9jVEFUdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:23:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<YGdx9zVEjKcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:24:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<WkwI+zVE8OaYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.142
country_id: 6252001
description:
Nov 23 03:26:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.142, lip=66.85.158.92, TLS: Connection closed, session=<xZCp/zVERLXHLZqO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 03:27:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<6rrvAjZE4sE+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:26:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</oPvADZETIsv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 03:30:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51688: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:30:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A2r1DzZEuNJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:31:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<eqLsEDZEPqhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:31:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<lUT+EDZE2uYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 03:32:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Fkn4FTZE7qQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:32:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Zd4kFjZEKtcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 03:32:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<UreLFzZEpqE+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 03:33:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<KaX3GjZEQIc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:33:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<nnJNGzZEHNKl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-23 03:34:15 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:52404: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:34:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<gmXBHjZEKrvIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:35:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<mfXmHzZEBp+PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-11-23 03:34:24 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:32992: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:34:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<7blwHjZEwKIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+RVvIDZE7MYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 03:36:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<PHczIzZEipg+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:36:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<YOGoJTZE5t0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 03:37:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<xspuJzZELuc+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:38:24 host2 sshd[3979212]: Disconnected from invalid user sl 64.227.76.143 port 34964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:38:53 host2 sshd[3979441]: Disconnected from invalid user irma 189.8.108.156 port 46026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 03:39:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<7vcuMDZEUMmWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.74.210
country_id: 6252001
description:
Nov 23 03:40:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.74.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<gkeeMTZEANcUDkrS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:41:09 host2 sshd[3981051]: Disconnected from invalid user astra 64.227.76.143 port 56176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 03:40:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<jnR6MzZENOIv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:42:14 host2 sshd[3981629]: Disconnected from invalid user naim 64.227.76.143 port 37938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.173
country_id: 3865483
description:
Nov 23 03:42:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@weeratrading.com>, method=PLAIN, rip=45.238.106.173, lip=66.85.158.91, TLS, session=<RvpfOTZE1oEt7mqt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.94
country_id: 3175395
description:
Nov 23 03:43:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.94, lip=66.85.158.91, TLS, session=<Ad7COjZEG43ZGrNe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:43:15 host2 sshd[3982180]: Disconnected from invalid user znc 64.227.76.143 port 34652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 03:43:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<f/22PDZEIv2nYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.62
country_id: 6252001
description:
Nov 23 03:42:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.62, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4h48OjZE9N0UQcM+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:43:25 host2 sshd[3982293]: Disconnected from invalid user support 34.66.72.251 port 59292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 03:43:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<GTBMPTZEfOgI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov 23 03:43:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.49, lip=66.85.158.91, TLS: Connection closed, session=<NFGEPjZEutKnXpIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 03:45:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<5gMyQzZEhtOYIMkL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-11-23 03:45:20 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:38745: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:44:25 host2 sshd[3982766]: Disconnected from invalid user steam1 34.66.72.251 port 43600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 03:44:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<P0MYQTZEvuRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 03:44:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+TeeQTZEkNUrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:44:47 host2 sshd[3982904]: Disconnected from invalid user rk 189.8.108.156 port 38120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.76.143
country_id: 2750405
description:
Nov 23 03:45:09 host2 sshd[3983384]: Disconnected from invalid user andrew 64.227.76.143 port 44048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 23 03:45:26 host2 sshd[3984133]: Disconnected from invalid user p 34.66.72.251 port 37054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-23 03:45:40 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:50174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:46:18 host2 sshd[3984949]: Disconnected from invalid user steam1 189.8.108.156 port 39424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 03:46:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=</2oWSDZEvoU+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.69
country_id: 798544
description:
Nov 23 03:46:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=77.65.142.69, lip=66.85.158.91, TLS, session=<HcKNRzZES5tNQY5F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Nov 23 03:46:40 host2 sshd[3985365]: Disconnected from invalid user ec2-user 34.93.128.179 port 46694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Nov 23 03:46:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<jJydSDZEHrvJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 03:46:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LPGFRzZEgARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 03:47:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<XtfVSzZEVpEv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:47:48 host2 sshd[3986493]: Disconnected from invalid user support 189.8.108.156 port 34352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 03:49:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<q+YQUzZE+oA+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-23 03:50:04 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:43997: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.107
country_id: 6252001
description:
2025-11-23 03:50:15 dovecot_login authenticator failed for ([70.174.168.107]) [70.174.168.107]:37475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 03:50:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<cABzVjZEGpw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 03:51:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<gJXtWDZEMrwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 03:51:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<3A3uWDZESsF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 23 03:51:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<oVy7WjZEJJwI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.8.108.156
country_id: 3469034
description:
Nov 23 03:52:10 host2 sshd[3990173]: Disconnected from invalid user astra 189.8.108.156 port 52978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 03:52:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<oIuPXDZEvOAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 03:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<4R+sZzZEBLLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 03:55:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<P5KkZzZEwuxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 03:55:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<AL6maDZEOqGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 03:55:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<j3jNaTZEsrAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 03:56:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<u91RbTZEBsYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 03:57:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<YBLlbjZEMqQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 03:58:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<h+K3dDZEJK6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 04:00:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<1/Y9ejZEnOIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 04:00:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<BLk5ejZEkKo+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Nov 23 04:03:49 host2 sshd[4003242]: Disconnected from invalid user main 69.74.29.21 port 15797 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 04:05:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<hBj9ijZEvOEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 04:05:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<8qYcizZEvNWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 04:05:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<WjdxizZEur2YIMkL>


