# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:17:22 host2 sshd[1360095]: Disconnected from invalid user jorge 198.12.77.137 port 42660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:17:07 host2 sshd[1359915]: Disconnected from invalid user admin 128.1.44.115 port 57880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:19:14 host2 sshd[1361350]: Disconnected from invalid user ankur 160.251.251.171 port 47580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.223
country_id: 1668284
description:
Nov 20 16:19:38 host2 sshd[1361705]: Disconnected from invalid user long 103.52.115.223 port 36186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.19
country_id: 3175395
description:
Nov 20 16:19:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.63.133.19, lip=66.85.158.91, TLS, session=<UWezcwREZN65P4UT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:20:49 host2 sshd[1362758]: Disconnected from invalid user arif 62.97.44.51 port 40414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.24
country_id: 798544
description:
Nov 20 16:20:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.125.4.24, lip=66.85.158.91, TLS, session=<VqbEdARE/6e5fQQY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:21:08 host2 sshd[1362973]: Disconnected from invalid user node1 160.251.251.171 port 33450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.77.137
country_id: 6252001
description:
Nov 20 16:21:32 host2 sshd[1363263]: Disconnected from invalid user epadmin 198.12.77.137 port 43332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:21:53 host2 sshd[1363484]: Disconnected from invalid user casa 62.97.44.51 port 34152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:22:58 host2 sshd[1364187]: Disconnected from invalid user ansadmin 62.97.44.51 port 49976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 20 16:23:23 host2 sshd[1364529]: Disconnected from invalid user admin 45.78.223.11 port 34580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:24:53 host2 sshd[1365688]: Disconnected from invalid user xyh 160.251.251.171 port 36014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:24:28 host2 sshd[1365452]: Disconnected from invalid user csgoserver 110.78.149.76 port 46750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:24:37 host2 sshd[1365527]: Disconnected from invalid user rizzo 103.166.187.238 port 55398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Nov 20 16:25:13 host2 sshd[1366036]: Disconnected from invalid user chrome 62.97.44.51 port 52748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:25:19 host2 sshd[1366141]: Disconnected from invalid user xyh 122.155.223.2 port 44781 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:25:58 host2 sshd[1366656]: Disconnected from invalid user jira 103.166.187.238 port 54796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:26:07 host2 sshd[1366786]: Disconnected from invalid user egarcia 128.1.44.115 port 35904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.166.187.238
country_id: 1210997
description:
Nov 20 16:27:18 host2 sshd[1367535]: Disconnected from invalid user git 103.166.187.238 port 49464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.2
country_id: 1605651
description:
Nov 20 16:27:23 host2 sshd[1367594]: Disconnected from invalid user hyper 122.155.223.2 port 26005 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:27:25 host2 sshd[1367613]: Disconnected from invalid user steam 128.1.44.115 port 46108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 20 16:28:39 host2 sshd[1368496]: Disconnected from invalid user reza 160.251.251.171 port 42610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.44.115
country_id: 1605651
description:
Nov 20 16:28:45 host2 sshd[1368554]: Disconnected from invalid user dev 128.1.44.115 port 47812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:28:13 host2 sshd[1368214]: Disconnected from invalid user admin 31.193.128.244 port 51184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:29:15 host2 sshd[1368895]: Disconnected from invalid user ubuntu 110.78.149.76 port 33604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:30:52 host2 sshd[1370398]: Disconnected from invalid user steam 110.78.149.76 port 48876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:32:11 host2 sshd[1371293]: Disconnected from invalid user ganesh 189.30.117.80 port 36696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:32:49 host2 sshd[1371686]: Disconnected from invalid user paco 31.193.128.244 port 34238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:33:35 host2 sshd[1372099]: Disconnected from invalid user steam 189.30.117.80 port 47666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov 20 16:33:09 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, session=<hflrpAREvMunXpI6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:35:06 host2 sshd[1373369]: Disconnected from invalid user admin 31.193.128.244 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Nov 20 16:34:18 host2 sshd[1372616]: Disconnected from invalid user laravel 189.30.117.80 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:35:06 host2 sshd[1373362]: Disconnected from invalid user kdh 179.216.23.19 port 45459 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.76
country_id: 1605651
description:
Nov 20 16:35:46 host2 sshd[1373938]: Disconnected from invalid user carla 110.78.149.76 port 59102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.193.128.244
country_id: 2635167
description:
Nov 20 16:38:35 host2 sshd[1376078]: Disconnected from invalid user dev 31.193.128.244 port 35606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:39:29 host2 sshd[1376742]: Disconnected from invalid user guest 179.216.23.19 port 1885 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:41:29 host2 sshd[1378671]: Disconnected from invalid user donavan 62.60.131.157 port 24855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.23.19
country_id: 3469034
description:
Nov 20 16:41:33 host2 sshd[1378748]: Disconnected from invalid user actions 179.216.23.19 port 1903 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 16:44:18 host2 sshd[1380842]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:44:21 host2 sshd[1380868]: Disconnected from invalid user r00t 188.247.31.91 port 49167 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 20 16:44:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<7q1ZzQREzoWUcdUX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.247.31.91
country_id: 163843
description:
Nov 20 16:45:44 host2 sshd[1382640]: Disconnected from invalid user admin 188.247.31.91 port 33372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-20 16:48:59 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:46248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:48:21 host2 sshd[1384688]: Disconnected from invalid user dev 101.47.143.192 port 36560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 16:49:16 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (matande) [81.225.30.107]:51426: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-20 16:49:48 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:34995: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:50:49 host2 sshd[1386792]: Disconnected from invalid user yusuf 101.47.143.192 port 34062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.192
country_id: 1880251
description:
Nov 20 16:55:42 host2 sshd[1391162]: Disconnected from invalid user bitwarden 101.47.143.192 port 51160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 16:59:26 host2 sshd[1394075]: Disconnected from invalid user draven 62.60.131.157 port 15555 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.224
country_id: 953987
description:
Nov 20 17:02:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=102.129.54.224, lip=66.85.158.91, TLS, session=<7ch/DQVE181mgTbg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.241
country_id: 3469034
description:
Nov 20 17:02:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.44.96.241, lip=66.85.158.91, TLS, session=<q5BLDAVEbq6xLGDx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-20 17:04:01 dovecot_plain authenticator failed for (scumnodied) [64.72.74.162]:45616: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2025-11-20 17:08:24 dovecot_plain authenticator failed for (wynon) [195.133.156.119]:43867: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.147
country_id: 3469034
description:
Nov 20 17:18:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=138.36.202.147, lip=66.85.158.91, TLS, session=<QwfoRgVEYtuKJMqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.85.160
country_id: 3469034
description:
Nov 20 17:19:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=200.237.85.160, lip=66.85.158.91, TLS, session=<85csSAVE+hDI7VWg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:25:23 host2 sshd[1416626]: Disconnected from invalid user rex 194.105.81.37 port 46194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:29:42 host2 sshd[1420418]: Disconnected from invalid user dns 45.205.30.37 port 41576 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 17:31:09 host2 sshd[1421701]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:33:07 host2 sshd[1423543]: Disconnected from invalid user bitcoin 45.205.30.37 port 38216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-20 17:33:46 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:59348: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-20 17:34:34 dovecot_login authenticator failed for (superviezzer.static.gvt.net.br) [177.159.99.95]:39590: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:34:34 host2 sshd[1424851]: Disconnected from invalid user victor 194.105.81.37 port 48398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.157.32
country_id: 337996
description:
2025-11-20 17:34:59 dovecot_login authenticator failed for ([196.189.44.177]) [196.190.157.32]:1306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:35:27 host2 sshd[1425822]: Disconnected from invalid user info 45.205.30.37 port 41420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
country_id: 1149361
description:
2025-11-20 17:35:18 dovecot_login authenticator failed for ([180.94.75.146]) [180.94.75.146]:40790: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.105.81.37
country_id: 2635167
description:
Nov 20 17:36:47 host2 sshd[1426831]: Disconnected from invalid user chrome 194.105.81.37 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:37:43 host2 sshd[1427831]: Disconnected from invalid user yousef 45.205.30.37 port 49206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.205.30.37
country_id: 6252001
description:
Nov 20 17:38:54 host2 sshd[1428877]: Disconnected from invalid user sbot 45.205.30.37 port 33356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-11-20 17:45:56 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (tedlembed) [73.68.220.15]:38668: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-20 17:48:19 dovecot_plain authenticator failed for (gited) [12.150.243.22]:3812: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Nov 20 17:58:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<gXic1QVEv9cfs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.120
country_id: 798544
description:
Nov 20 17:59:04 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.101.120, lip=66.85.158.91, TLS, session=<M2Sx1gVEeNyy22V4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-20 18:03:14 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (hellinecty) [71.224.169.28]:57942: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-20 18:06:04 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:37864: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 18:11:26 host2 sshd[1461484]: Disconnected from invalid user jameson 62.60.131.157 port 21214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.222
country_id: 3996063
description:
2025-11-20 18:15:03 dovecot_login authenticator failed for ([201.172.88.222]) [201.172.88.222]:48918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Nov 20 18:15:36 host2 pure-ftpd[1464749]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.175
country_id: 798544
description:
Nov 20 18:18:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=109.125.247.175, lip=66.85.158.91, TLS, session=<X21cHQZEIbBtffev>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.200
country_id: 3077311
description:
Nov 20 18:19:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.163.38.200, lip=66.85.158.91, TLS, session=<1I2eHgZEupRVoybI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 18:24:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59471: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.89.179.43
country_id: 6252001
description:
Nov 20 18:25:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=35.89.179.43, lip=66.85.158.91, TLS: Connection closed, session=<FcDUNwZE8NcjWbMr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.176.214.185
country_id: 6252001
description:
Nov 20 18:35:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.176.214.185, lip=66.85.158.91, TLS: Connection closed, session=<RQmiWgZEwsE2sNa5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.7
country_id: 3865483
description:
Nov 20 18:40:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.89.7, lip=66.85.158.91, TLS, session=<C+hoawZER8W+tVkH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.109.30
country_id: 2510769
description:
Nov 20 18:40:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.156.109.30, lip=66.85.158.91, TLS, session=<7uSdbAZE/bOynG0e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 18:42:15 host2 sshd[1485268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.120
country_id: 3469034
description:
Nov 20 18:42:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.250.120, lip=66.85.158.91, TLS, session=<ThwycQZE9MG60fp4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.90.2.146
country_id: 798544
description:
Nov 20 18:42:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=45.90.2.146, lip=66.85.158.91, TLS, session=<xZNjcgZE/8MtWgKS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:45:10 host2 sshd[1488037]: Disconnected from invalid user admin 107.172.146.104 port 60182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:46:08 host2 sshd[1488688]: Disconnected from invalid user guest 51.222.106.104 port 42612 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<sLPWgwZECuzPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 20 18:47:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<0PbagwZE3r3PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:48:28 host2 sshd[1490400]: Disconnected from invalid user user 51.222.106.104 port 60080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:49:21 host2 sshd[1491061]: Disconnected from invalid user elena 107.172.146.104 port 43944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:49:42 host2 sshd[1491500]: Disconnected from invalid user andre 51.222.106.104 port 36972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-20 18:50:53 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (mentiantly) [81.226.88.121]:35104: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.254.74.120
country_id: 6252001
description:
Nov 20 18:51:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=44.254.74.120, lip=66.85.158.92, TLS: Connection closed, session=<VCzNkgZESqks/kp4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.146.104
country_id: 6252001
description:
Nov 20 18:51:38 host2 sshd[1493231]: Disconnected from invalid user andre 107.172.146.104 port 37572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 20 18:57:19 host2 sshd[1498548]: Disconnected from invalid user front 51.222.106.104 port 44982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.222.104.59
country_id: 6252001
description:
Nov 20 18:58:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=34.222.104.59, lip=66.85.158.92, TLS: Connection closed, session=<RYveqgZEJroi3mg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-20 18:58:12 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (ancers) [68.60.77.128]:53340: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-20 18:59:04 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42422: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-20 18:59:15 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:58506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:02:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dr5WugZEyo0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:03:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<d7qJvgZElOIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:05:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<3k5LxQZEsMgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:07:24 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<DtkPzAZETqADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.190
country_id: 3469034
description:
Nov 20 19:10:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.209.246.190, lip=66.85.158.91, TLS, session=<jgiC1AZEVZ+60fa+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.246
country_id: 6290252
description:
Nov 20 19:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=109.207.34.246, lip=66.85.158.91, TLS, session=<z0ti0wZErrNtzyL2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:10:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<y4ne1QZEeNYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 20 19:11:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<333H2wZElOUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.92, session=<YcWR4AZEPT/OvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.67.48
country_id: 2921044
description:
Nov 20 19:13:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.67.48, lip=66.85.158.92, session=<OYWY4AZEkGaGekMw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.252
country_id: 2921044
description:
Nov 20 19:16:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.74.252, lip=66.85.158.92, TLS, session=<IJHr7AZEMvKl6Er8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:20:07 host2 sshd[1517644]: Disconnected from invalid user public 45.78.220.116 port 37134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.79
country_id: 6251999
description:
Nov 20 19:21:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.79, lip=66.85.158.91, TLS: Connection closed, session=<Pp4w/QZEtMyUccFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.128.246.187
country_id: 6252001
description:
Nov 20 19:21:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=138.128.246.187, lip=66.85.158.91, TLS: Connection closed, session=<MA0LAAdEvzKKgPa7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-20 19:25:17 dovecot_login authenticator failed for (nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:40736: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-20 19:25:27 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:46673: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:25:49 host2 sshd[1522211]: Disconnected from invalid user user1 198.1.117.220 port 43674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:29:01 host2 sshd[1523883]: Disconnected from invalid user user 198.1.117.220 port 50264 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 19:29:37 host2 sshd[1524339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-20 19:31:05 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:59536: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-20 19:31:24 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:48786: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 20 19:33:47 host2 sshd[1527605]: Disconnected from invalid user app 198.1.117.220 port 49818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.116
country_id: 1880251
description:
Nov 20 19:35:06 host2 sshd[1528653]: Disconnected from invalid user user3 45.78.220.116 port 40594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.101.69
country_id: 3057568
description:
Nov 20 19:37:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=31.134.101.69, lip=66.85.158.91, TLS, session=<HjmpNgdEw+MfhmVF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.0.105.88
country_id: 2510769
description:
Nov 20 19:37:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.0.105.88, lip=66.85.158.91, TLS, session=<GD67NwdEl8ElAGlY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.106
country_id: 3996063
description:
Nov 20 19:39:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=38.65.137.106, lip=66.85.158.91, TLS, session=<F5+APAdEq8kmQYlq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Nov 20 19:39:28 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<Ln+iPQdEkKEr5eEz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.166.146
country_id: 6251999
description:
Nov 20 19:53:54 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=137.184.166.146, lip=66.85.158.91, TLS, session=<CXNkcgdExuiJuKaS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 19:57:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OlROfwdEQuii2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 19:57:36 host2 sshd[1547596]: Disconnected from invalid user ftp1 152.32.129.140 port 24572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:00:30 host2 sshd[1550180]: Disconnected from invalid user odoo 85.133.237.167 port 37222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:01:26 host2 sshd[1550836]: Disconnected from invalid user dan 152.32.129.140 port 24936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.49
country_id: 6252001
description:
Nov 20 20:01:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.49, lip=66.85.158.92, TLS, session=<8ETKjgdEruGi2JYx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:02:53 host2 sshd[1552023]: Disconnected from invalid user mc2 85.133.237.167 port 33086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:02:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Q81XkgdESJkI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 20:03:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<AdbIlQdEssRSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 20:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<SlM9mgdERUMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:05:34 host2 sshd[1554637]: Disconnected from invalid user ubuntu 152.32.129.140 port 54236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:05:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<xsBdnQdEKrdn76Vy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:05:10 host2 sshd[1554371]: Disconnected from invalid user karim 51.178.141.222 port 35424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:05:19 host2 sshd[1554505]: Disconnected from invalid user es 79.112.19.63 port 51286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-20 20:06:47 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:42464: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:06:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<J//voAdEZIIjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:06:16 host2 sshd[1555161]: Disconnected from invalid user xxx 51.178.141.222 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:06:26 host2 sshd[1555268]: Disconnected from invalid user bad 85.133.237.167 port 40460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:07:35 host2 sshd[1556051]: Disconnected from invalid user incoming 85.133.237.167 port 47974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-20 20:07:38 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:34506: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.167
country_id: 130758
description:
Nov 20 20:08:43 host2 sshd[1556777]: Disconnected from invalid user emo 85.133.237.167 port 36616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:09:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<6URrqAdEvueLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:09:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<tU49qwdEfHxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 20:10:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=</z08rQdEhpCYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:10:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<KtMdrgdEdlgI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 20:11:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<YrwOsAdE9tOLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:11:29 host2 sshd[1558693]: Disconnected from invalid user red 79.112.19.63 port 34718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Nov 20 20:11:46 host2 sshd[1558844]: Disconnected from invalid user red 51.178.141.222 port 60932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 20 20:11:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=8.216.40.228, lip=66.85.158.91, session=<cB6ysgdE5tQI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.25.110.103
country_id: 2635167
description:
Nov 20 20:11:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=82.25.110.103, lip=66.85.158.91, session=<0FvIsgdE4L1SGW5n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.140
country_id: 798544
description:
Nov 20 20:12:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=91.246.209.140, lip=66.85.158.91, TLS, session=<xBywswdEgdNb9tGM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:12:36 host2 sshd[1559353]: Disconnected from invalid user test 110.93.250.15 port 46658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.16
country_id: 3469034
description:
Nov 20 20:12:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.240.37.16, lip=66.85.158.91, TLS, session=<8JLHtAdEsI2/8CUQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 20 20:13:33 host2 sshd[1560062]: Disconnected from invalid user steam 152.32.129.140 port 57832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:13:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<AVfNuAdELL0I3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:14:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Q9A5vQdEBNai2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 20:15:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<oWH4vwdEWIaUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:15:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<K0m9wAdEfPui2JZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:15:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<fLj1vgdEpqQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 20:15:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<ljNFvwdE/Lln76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 20:16:47 host2 sshd[1562027]: Disconnected from invalid user alycia 62.60.131.157 port 8471 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:17:15 host2 sshd[1562341]: Disconnected from invalid user user 110.93.250.15 port 13173 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-20 20:17:19 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pergulae) [81.225.30.107]:39823: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Nov 20 20:18:22 host2 sshd[1562978]: Disconnected from invalid user devuser 79.112.19.63 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.93.250.15
country_id: 1168579
description:
Nov 20 20:18:49 host2 sshd[1563183]: Disconnected from invalid user dan 110.93.250.15 port 23328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 20:19:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<0P0RzAdEGJkv+1FF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 20:19:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<oS+jzAdEiN6l6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.100
country_id: 6252001
description:
Nov 20 20:19:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.100, lip=66.85.158.91, TLS, session=<mkjNzQdEou+i2JZk>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 20:22:51 host2 sshd[1566224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:22:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<Nqjd2AdEtONrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:22:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<a5Cy2QdEarQI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 20:23:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Y4OR2wdEQJAv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 20 20:23:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<dC073QdECMOH6yFP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-11-20 20:24:48 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:17414: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 20:24:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+VUA4QdEUoSPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-20 20:24:22 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:33022: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 20:26:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wf0/5QdE+LUEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 20:26:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<zOpF5wdEINpn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-20 20:27:46 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (andapsyper) [98.192.114.251]:50798: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov 20 20:27:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<Mfok7AdERIII2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 20 20:30:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<9QjC9AdEGrpe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 20:30:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<85Xh9AdEMs5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 20:30:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<0mJw9gdEgKwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 20:33:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<dYUl/wdE0Mho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 20:35:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<b/HGBghEsJuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 20:35:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<A/SRBwhE4O3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 20:37:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<ZkmJDAhEIMBrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-20 20:38:05 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:38748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:39:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wGjPEwhEYqcjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-20 20:38:43 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:56401: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.114
country_id: 298795
description:
Nov 20 20:42:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=95.0.32.114, lip=66.85.158.91, TLS, session=<qadvHQhEjpBfACBy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 20:41:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<9midGwhEoswI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Nov 20 20:42:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<cfATHwhEMqLEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.0.119
country_id: 2300660
description:
Nov 20 20:43:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=41.139.0.119, lip=66.85.158.91, TLS, session=<p7uSIwhEquQpiwB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.123
country_id: 798544
description:
Nov 20 20:44:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=195.205.4.123, lip=66.85.158.91, TLS, session=<mTq3JAhE5t3DzQR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 20:43:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wRhMIwhEetIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 20:43:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<miDGIwhEroVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 20:44:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<H5rPJghE9IaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 20:51:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<EYpZQQhE5oBnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 20:51:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<zrtaQAhEktpAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 20:55:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<9ezbTwhEBOql0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 20:58:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<V5d2WQhE/MSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 21:01:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<2h7HZAhE6JOUcQ1r>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 20 21:01:46 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS, session=<5dQSZQhEpd5X7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.157
country_id: 6252001
description:
Nov 20 21:02:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.157, lip=66.85.158.91, session=<pjIpZwhE/0ZAPpyd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 20 21:02:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS: Connection closed, session=<ZT3uZwhE5m5APpyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 21:03:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1ezuaQhE3txnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 21:04:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<BW2TbghEZsmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 21:05:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<UWDlcwhEuNgrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 21:07:02 host2 sshd[1601098]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 21:06:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<bniVdghEaMln76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 21:06:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5xQfdwhEqt6LO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.123.36
country_id: 6252001
description:
Nov 20 21:08:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=142.93.123.36, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2EwhfghELMaOXXsk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:08:51 host2 sshd[1602253]: Disconnected from invalid user zahid 189.112.0.11 port 50548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 21:10:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<W/f5gghELNwI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 20 21:11:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<RwRKhwhE3KsXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 21:13:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ezUokAhEvsVnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:16:04 host2 sshd[1609049]: Disconnected from invalid user supervisor 189.112.0.11 port 54336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 21:16:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<la8mmAhEAJBSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:15:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2ONTlQhEGJkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 21:16:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<987amghE/tOYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 21:17:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<dSRAnAhEQsxn76Vy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Nov 20 21:17:41 host2 pure-ftpd[1610241]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 21:18:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<EH9bnwhEAuZrhr+5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Nov 20 21:18:53 host2 sshd[1611020]: Disconnected from invalid user it 189.112.0.11 port 57200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 21:21:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Mv6dqwhEsJto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 20 21:24:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=8.216.40.228, lip=66.85.158.91, session=<z5VEtQhENM8I2Cjk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Nov 20 21:24:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<bZMKtwhEdh+nXpI0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.175.194.50
country_id: 6252001
description:
2025-11-20 21:25:34 dovecot_plain authenticator failed for (158-94-208-178.virtualine.org) [136.175.194.50]:22241: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 21:28:02 host2 sshd[1618540]: Disconnected from invalid user clifton 62.60.131.157 port 62868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-20 21:28:14 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:54233: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-20 21:28:34 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:37378: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 21:29:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<AiuOyAhELJ8v+1FF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Nov 20 21:30:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.92, TLS: Connection closed, session=<v8HxyghEkl2nXpI7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 147.185.242.186
country_id: 6252001
description:
Nov 20 21:30:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=147.185.242.186, lip=66.85.158.91, TLS: Connection closed, session=<3R3YywhE1wyTufK6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 21:30:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Ui4KzAhEhLWUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 20 21:32:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, session=<V2uY0whEFqhKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 21:33:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rSqJ1QhE8qil6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 21:33:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<buzZ1QhEpqkv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 21:33:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<v8zX1ghENLhrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 21:36:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1H/Z4ghEaLuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.25.110.103
country_id: 2635167
description:
Nov 20 21:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=82.25.110.103, lip=66.85.158.91, session=<MkGR5QhEtNNSGW5n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 21:39:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<rLPr6ghEmusI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 21:39:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=</uIu7QhE0K8v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.194
country_id: 3469034
description:
Nov 20 21:39:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.130.170.194, lip=66.85.158.91, TLS, session=<Jp1y7AhE2LixgqrC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.117.77
country_id: 3469034
description:
Nov 20 21:40:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.22.117.77, lip=66.85.158.91, TLS, session=<xsqn7QhE39OxFnVN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 21:40:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<zdWh8AhElLwEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.89.235.196
country_id: 6252001
description:
Nov 20 21:41:15 host2 sshd[1629507]: Disconnected from invalid user adminer 47.89.235.196 port 53462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 21:41:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<bBA88ghE7KZn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.199
country_id: 3469034
description:
Nov 20 21:41:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=45.7.187.199, lip=66.85.158.91, TLS, session=<1xNL8ghEerAtB7vH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.106.14
country_id: 798544
description:
Nov 20 21:41:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=178.219.106.14, lip=66.85.158.91, TLS, session=<hZaA8whEe92y22oO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.89.235.196
country_id: 6252001
description:
Nov 20 21:42:32 host2 sshd[1630846]: Disconnected from invalid user minecraft 47.89.235.196 port 55044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:43:40 host2 sshd[1633126]: Disconnected from invalid user es 177.53.215.134 port 59214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:43:47 host2 sshd[1634160]: Disconnected from invalid user hl 118.26.39.178 port 44564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 21:45:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Rx5MAAlEVMdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 21:45:40 host2 sshd[1645490]: Disconnected from invalid user dejah 62.60.131.157 port 34494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:46:54 host2 sshd[1646285]: Disconnected from invalid user mostafa 118.26.39.178 port 46846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:48:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IJHTCwlENH0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-11-20 21:48:55 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:50270: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 21:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<R5ikDQlEOtXIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-20 21:49:15 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:44820: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.84
country_id: 6252001
description:
Nov 20 21:49:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.84, lip=66.85.158.92, session=<QxJOEAlEwSpBMQFU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:49:48 host2 sshd[1648672]: Disconnected from invalid user fivem 118.26.39.178 port 58624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Nov 20 21:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.80, lip=66.85.158.92, TLS: Connection closed, session=<VN8bEQlEnC9BMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-11-20 21:50:43 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:34657: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-20 21:50:51 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:59037: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Nov 20 21:51:41 host2 pure-ftpd[1650165]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 21:52:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=</gGdGAlEvJBm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 21:53:00 host2 sshd[1651042]: Disconnected from invalid user ilaria 101.47.142.10 port 56488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Nov 20 21:52:49 host2 sshd[1650967]: Disconnected from invalid user ads1 118.26.39.178 port 44610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 21:52:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Qn+6GwlERKojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 20 21:56:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<gGhCJwlEPt5e0RIJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:56:49 host2 sshd[1654285]: Disconnected from invalid user kdm 177.53.215.134 port 55918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov 20 21:58:07 host2 sshd[1655050]: Disconnected from invalid user ads1 177.53.215.134 port 58418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 21:57:50 host2 sshd[1654877]: Disconnected from invalid user justin 101.47.142.10 port 50932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 22:00:33 host2 sshd[1656489]: Disconnected from invalid user jamshid 101.47.142.10 port 33842 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.75.124
country_id: 597427
description:
Nov 20 22:02:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=69.62.75.124, lip=66.85.158.91, session=<QlJ/PQlEBJ9FPkt8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 22:02:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<A8tZPwlEdJRAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 22:02:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<czFIPwlExo6LO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.10
country_id: 1880251
description:
Nov 20 22:03:13 host2 sshd[1658069]: Disconnected from invalid user test3 101.47.142.10 port 58590 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:03:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<k4/oQAlEmqNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 22:03:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<TXlAQglEYruSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 22:05:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<a+IJSAlE/J+LO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:05:28 host2 sshd[1660519]: Disconnected from invalid user dev 193.106.245.20 port 34738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:07:43 host2 sshd[1661708]: Disconnected from invalid user angela 83.118.24.18 port 56432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:08:07 host2 sshd[1661982]: Disconnected from invalid user kali 193.106.245.20 port 35645 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:08:59 host2 sshd[1662371]: Disconnected from invalid user stack 34.142.110.144 port 44358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 22:08:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+E2uUwlEzowI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 22:08:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<Bi+VUwlEXrlnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.35.162
country_id: 3469034
description:
Nov 20 22:09:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.37.35.162, lip=66.85.158.91, TLS, session=<hQ+oVQlEPdy/JSOi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.202
country_id: 1269750
description:
Nov 20 22:09:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.30.81.202, lip=66.85.158.91, TLS, session=<T+juVglEvJpnHlHK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:10:05 host2 sshd[1663025]: Disconnected from invalid user marc 34.142.110.144 port 43402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 22:10:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<UnGjWQlEJtukXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:10:42 host2 sshd[1663511]: Disconnected from invalid user temp 193.106.245.20 port 42865 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:11:37 host2 sshd[1663970]: Disconnected from invalid user ubuntu 83.118.24.18 port 51514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 22:12:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<oUQBYQlErNtn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.20
country_id: 1880251
description:
Nov 20 22:12:26 host2 sshd[1664782]: Disconnected from invalid user gitlab-runner 101.47.162.20 port 42506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Nov 20 22:13:26 host2 sshd[1665649]: Disconnected from invalid user angela 193.106.245.20 port 43752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Nov 20 22:14:36 host2 sshd[1666156]: Disconnected from invalid user storage 34.142.110.144 port 39592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.20
country_id: 1880251
description:
Nov 20 22:15:01 host2 sshd[1666390]: Disconnected from invalid user robert 101.47.162.20 port 56762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 22:15:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<LfrPawlEhJJrhr+5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.118.24.18
country_id: 1605651
description:
Nov 20 22:15:35 host2 sshd[1667195]: Disconnected from invalid user liming 83.118.24.18 port 37896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 22:18:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<73LCdQlErI+UcQ1r>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 22:19:05 host2 sshd[1669897]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 22:21:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<r2YPgwlEbuOl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 22:22:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<nd7AhglEiN5n76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 22:23:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<MuteiAlExGovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:23:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ntNWiQlEsLlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 22:25:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sj09kAlEqqsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 22:25:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<6KP6kAlEnO0rpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 20 22:28:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZMFfmwlE73xAPpx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 22:28:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<YUpsnAlEiLmYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 22:30:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<Dlq6owlEpp9rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-20 22:32:56 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:57666: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 22:32:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<CeIHqwlELrZSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-20 22:33:16 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:4391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.212
country_id: 6252001
description:
Nov 20 22:34:10 host2 pure-ftpd[1681928]: (?@64.62.197.212) [INFO] New connection from 64.62.197.212


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 22:34:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<NcbIrwlECmVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 22:34:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<EaP7rwlEQuNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.66.136
country_id: 6252001
description:
Nov 20 22:36:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.66.136, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ES6fuAlE+qKkXEKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.154
country_id: 953987
description:
Nov 20 22:37:11 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.129.57.154, lip=66.85.158.91, TLS, session=<UsH3uAlEnKFmgTma>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.167.34
country_id: 3865483
description:
Nov 20 22:37:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.181.167.34, lip=66.85.158.91, TLS, session=<0chuuglEIpkttaci>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 22:37:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<er1hvAlEXJwI3ocK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-20 22:38:28 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57252: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.229.31.216
country_id: 690791
description:
Nov 20 22:38:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.229.31.216, lip=66.85.158.91, TLS, session=<oxKYvglErt9t5R/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.75
country_id: 2300660
description:
Nov 20 22:39:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<art>, method=PLAIN, rip=41.139.10.75, lip=66.85.158.91, TLS, session=<3j7VvwlE85MpiwpL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 22:41:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<fdlgyQlE2KYv+1FF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-20 22:43:03 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50666: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-20 22:42:36 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:33570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-20 22:43:36 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:59832: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 22:44:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<Ruxp0wlEsMUv/DJe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.167
country_id: 6252001
description:
Nov 20 22:46:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</MoA3QlEmN8UQcKn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 22:47:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<N70g3wlE/t6UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 20 22:48:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fZwP4wlEuoSl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.248.118
country_id: 6252001
description:
Nov 20 22:48:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.248.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<l9wX5AlEXOgoTPh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 20 22:50:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<I8IZ6AlEFJSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 20 22:49:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<H7Se5glESqMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 20 22:50:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<jMaT6QlEuokv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 20 22:54:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Itgf+AlEDA7Y2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 20 22:54:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=135.235.33.79, lip=66.85.158.91, session=<JfbC+AlEat6H6yFP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov 20 22:55:25 host2 pure-ftpd[1699357]: (?@205.210.31.92) [INFO] New connection from 205.210.31.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 22:56:10 host2 sshd[1700113]: Disconnected from invalid user emmalee 62.60.131.157 port 6307 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 20 22:56:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Izhr/wlEMKYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 22:58:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kCuoBQpEoLVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 22:58:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<xO7eBwpEZEkjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.87
country_id: 6252001
description:
Nov 20 23:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.155.87, lip=66.85.158.92, TLS: Connection closed, session=<oVKQDwpEUCfHLZtX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 23:01:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<JYGIEApEBqaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 23:03:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5anLFwpE7qMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 20 23:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<9v4tGQpEdtKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 20 23:03:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<aOpQGQpE3tJn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 20 23:04:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<KBlmHQpEvubIMGRT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 20 23:06:19 host2 sshd[1708517]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.23
country_id: 3175395
description:
Nov 20 23:06:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.170.23, lip=66.85.158.91, TLS, session=<YFlDIgpEKdm5D6oX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.247
country_id: 3865483
description:
Nov 20 23:06:53 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.177.200.247, lip=66.85.158.91, TLS, session=<+N1hIwpEDNQtscj3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 23:07:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<YrGtJQpEzKsI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 23:12:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<L4rpNwpESLNrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 20 23:13:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<Z2QJPApE3OZm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 20 23:15:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=</26aQQpE5otAF/Qn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.214.99
country_id: 6251999
description:
Nov 20 23:16:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.214.99, lip=66.85.158.92, TLS: Connection closed, session=<gArJRwpEFNOUcdZj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.9
country_id: 6252001
description:
Nov 20 23:17:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.9, lip=66.85.158.91, session=<Y/0VSQpESNgUQcIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 23:17:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<tg2zSgpE1u1n76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-20 23:19:32 dovecot_login authenticator failed for ([165.169.82.194]) [165.169.82.194]:54783: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-20 23:19:54 dovecot_login authenticator failed for (nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:57854: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Nov 20 23:20:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<1WEAVQpEsO64aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 20 23:21:07 host2 pure-ftpd[1720953]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 20 23:22:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BCPFXQpE2K+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:24:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nVUpYwpEUNBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 20 23:25:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<9to6aApEEMRnmSo4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov 20 23:26:11 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.92, session=<oS2KaQpELoWsaAsi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 20 23:28:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<cW4JcApEeKlrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 20 23:28:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<lHAVcApEWIJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 23:32:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<q5LTgApEAr6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 20 23:34:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<iQnViApEdPsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 20 23:35:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Hn1higpE1MaUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 20 23:36:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JYCZjQpE1HAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 20 23:36:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<uhfujgpEQLsI3ocK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.68
country_id: 6252001
description:
Nov 20 23:39:23 host2 pure-ftpd[1734964]: (?@184.105.139.68) [INFO] New connection from 184.105.139.68


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 20 23:41:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<pz5OoQpERreSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 20 23:41:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<rLUvoQpEIuGYNbyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.0.89.94
country_id: 226074
description:
Nov 20 23:43:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=196.0.89.94, lip=66.85.158.91, session=<5PSDpwpE0+TEAFle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.65
country_id: 3175395
description:
Nov 20 23:43:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=217.26.179.65, lip=66.85.158.91, TLS, session=</cuWpwpEDNrZGrNB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:45:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<bC/frApECKFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 20 23:45:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<e1UfrwpEDpQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 20 23:46:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<isLkswpE5kFBMQHA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 20 23:47:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Q6sDtQpEDgRo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-20 23:47:27 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:53210: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 20 23:47:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2ZIPtQpE2D9BMQHA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 20 23:48:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<jJ47uQpE3rSl0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 20 23:48:44 host2 sshd[1741331]: Disconnected from invalid user emmalee 62.60.131.157 port 18584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 20 23:50:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<+JSDwQpEqshSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 20 23:53:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<xqloygpEvq0v+1FF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Nov 20 23:53:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<e1OsygpEdr5ChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-20 23:55:57 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:47166: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 20 23:55:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gdTw0wpEptJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-20 23:55:38 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:63387: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 20 23:55:50 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<0I990wpEht8v/DJe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.77
country_id: 6252001
description:
Nov 20 23:56:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VTQr1QpER9XG6xhN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-20 23:56:21 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:50369: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-20 23:56:40 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:41164: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:00:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Id6Y4gpEvM2LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 21 00:01:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<dm645wpESLQv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:02:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<taBK6wpE3siLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.157
country_id: 2635167
description:
Nov 21 00:03:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.157, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kbuh7wpEiZm594md>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 21 00:03:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@maximsholdings.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<k+LH7wpEmKGPbtX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.156
country_id: 2635167
description:
Nov 21 00:03:40 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.156, lip=66.85.158.92, TLS, session=<Ri2V7wpEf7K594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Nov 21 00:04:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0Dud8QpEUcC594me>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 00:04:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<8fZw8QpE+sCl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 21 00:04:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<D4WZ8wpEseG594mf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 21 00:04:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Q/Ae9ApEANuUcQ1r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.168
country_id: 2635167
description:
Nov 21 00:05:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.168, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<l/mU9QpEN55X7LCo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.162
country_id: 2635167
description:
Nov 21 00:05:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.162, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<hFuQ9wpEC4y594mi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 00:05:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<wp6c9wpEpMoI3ocK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.151
country_id: 2635167
description:
Nov 21 00:06:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.151, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a/KJ+QpEUYFX7LCX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.177
country_id: 2635167
description:
Nov 21 00:07:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oLqH+wpEwai594mx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.149
country_id: 2635167
description:
Nov 21 00:08:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.149, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<n199/wpEz71X7LCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.147
country_id: 2635167
description:
Nov 21 00:07:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.147, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Xa6D/QpEX+W594mT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.172
country_id: 2635167
description:
Nov 21 00:08:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<jBB5AQtEAaO594ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.80.149
country_id: 6252001
description:
Nov 21 00:09:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.80.149, lip=66.85.158.92, session=<T+bBAwtEls0ofFCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 00:09:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<KCQBBgtEFIFrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:10:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@euroentertainmentlk.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LkspBwtEeCsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 21 00:11:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</hl7CwtEEqFo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.235.33.79
country_id: 6252001
description:
Nov 21 00:13:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=135.235.33.79, lip=66.85.158.91, session=<dJ8dEgtEKp+H6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:14:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@nsteeleng.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UD5WFwtEpEQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.39.24
country_id: 2395170
description:
Nov 21 00:15:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=154.127.39.24, lip=66.85.158.91, TLS, session=<TdsUFwtEcbSafycY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.57
country_id: 953987
description:
Nov 21 00:15:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.52.57, lip=66.85.158.91, TLS, session=<L1pKGAtE74hmgTQ5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.107
country_id: 798544
description:
Nov 21 00:16:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=212.59.224.107, lip=66.85.158.91, TLS, session=<itjtHAtEkcXUO+Br>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.250
country_id: 6290252
description:
Nov 21 00:16:55 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=109.207.35.250, lip=66.85.158.91, TLS, session=<HEr/HQtEq8JtzyP6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 00:17:33 host2 sshd[1763208]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.209.47
country_id: 3865483
description:
2025-11-21 00:20:16 dovecot_login authenticator failed for (cpe-186-23-209-47.telecentro-reversos.com.ar) [186.23.209.47]:54438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.192.158
country_id: 1269750
description:
2025-11-21 00:20:36 dovecot_login authenticator failed for (dsl-kk-static-158.192.95.61.airtelbroadband.in) [61.95.192.158]:56764: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 21 00:21:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<BmNULgtEHKTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 00:22:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<7CAwNAtEnJFn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 00:25:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<9ZRuPgtEKMhrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 21 00:27:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colourmarklabels.com>, method=PLAIN, rip=64.23.244.39, lip=66.85.158.91, session=<05vyQwtEMq5AF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 00:27:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3hpURgtEItgXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.235
country_id: 6252001
description:
Nov 21 00:29:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.235, lip=66.85.158.91, TLS handshaking: Connection closed, session=<G5zuTAtEP5DDuEzr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.239
country_id: 6252001
description:
Nov 21 00:29:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.239, lip=66.85.158.91, TLS: Connection closed, session=<rumMTQtE/5HDuEzv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.10
country_id: 6252001
description:
Nov 21 00:30:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.10, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xMI2TgtEFdnDuEwK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Nov 21 00:30:10 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.91, TLS: Connection closed, session=<VitlTgtEv8zDuEzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.223
country_id: 3865483
description:
Nov 21 00:32:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=190.181.97.223, lip=66.85.158.91, TLS, session=<SGFMVAtEMqC+tWHf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.155.4
country_id: 3077311
description:
Nov 21 00:32:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=80.82.155.4, lip=66.85.158.91, TLS, session=<3eZsVQtEDdxQUpsE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 00:33:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<OmLYWQtEbJRn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 00:34:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<oGTQXgtEkrxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 00:34:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<aMZWXwtEbshm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 00:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<FLi/YAtEFtoI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 00:36:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<m0C2YwtECq2kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:42:14 host2 sshd[1781822]: Disconnected from invalid user hussain 187.174.238.116 port 40232 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 00:44:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@bostonlanka.com>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<NW3xgAtEGoNnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:46:05 host2 sshd[1784536]: Disconnected from invalid user testusr 187.174.238.116 port 37728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 21 00:46:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@euroentertainmentlk.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CbMCiQtEQsNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 00:47:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<sDAXjQtEbZIvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Nov 21 00:48:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VPB7jgtEgpQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:48:25 host2 sshd[1785981]: Disconnected from invalid user mt 187.174.238.116 port 36054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 21 00:51:57 host2 sshd[1788019]: Disconnected from invalid user new 187.174.238.116 port 33542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.10.250
country_id: 2328926
description:
Nov 21 00:52:26 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.10.250, lip=66.85.158.92, session=<vKMHngtEttqlmgr6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov 21 00:53:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<98/soAtEPu2UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 00:54:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<jXBfpQtEVqGYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 00:55:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<zl66qQtEnNVe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 00:59:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<eu1YtQtELKSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.149
country_id: 798544
description:
Nov 21 00:58:08 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=178.216.31.149, lip=66.85.158.91, TLS, session=<UgRZsQtE5Lyy2B+V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.134
country_id: 3469034
description:
Nov 21 00:58:29 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art>, method=PLAIN, rip=186.209.251.134, lip=66.85.158.91, TLS, session=<gseKsgtETMO60fuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 21 01:01:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ldL1vQtEgHZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 01:01:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<35QOvgtEHtqLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.10.250
country_id: 2328926
description:
Nov 21 01:03:39 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.10.250, lip=66.85.158.91, session=<h5EbxgtExo6lmgr6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 01:04:35 host2 sshd[1796094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 01:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<eiYIywtEjukI3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.81.69
country_id: 6252001
description:
Nov 21 01:05:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=47.251.81.69, lip=66.85.158.91, session=<OWLXywtEkLUv+1FF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 01:07:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<7NYm0gtEpK4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov 21 01:07:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<aj1+0wtEgt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.50.94
country_id: 6252001
description:
Nov 21 01:07:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.252.50.94, lip=66.85.158.91, session=<S1JF1AtE2Isv/DJe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 21 01:07:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=107.134.191.185, lip=66.85.158.91, session=<puyl1AtEoM5rhr+5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 21 01:09:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<uAK32QtEqLOnXpI8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 21 01:09:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=82.115.48.179, lip=66.85.158.91, session=<keDK2wtEip9SczCz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Nov 21 01:09:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<Ddzs2wtEvpRChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 21 01:11:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<9A3U4AtE1CxChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.237.197.102
country_id: 6252001
description:
2025-11-21 01:14:09 dovecot_plain authenticator failed for ec2-54-237-197-102.compute-1.amazonaws.com (EC2AMAZ-Q5TBN4B.ec2.internal) [54.237.197.102]:57318: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 21 01:14:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<+Of66wtEgqov+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.102
country_id: 1269750
description:
Nov 21 01:22:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@casa18villa.com>, method=PLAIN, rip=103.246.170.102, lip=66.85.158.91, TLS, session=<IGqyBgxEVeln9qpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.88.98
country_id: 3469034
description:
Nov 21 01:22:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.22.88.98, lip=66.85.158.91, TLS, session=<eEIOCAxE3KqxFlhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 01:30:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lPtvJAxEttSLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 21 01:33:39 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<vWdlMQxEjLdChJlx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 01:34:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<6KMxNQxE5mItTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 01:37:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<XqjoPQxEzOlm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 01:38:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<h2faQQxEIM8v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 01:38:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<S9VdQgxENJkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 01:40:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<tFMOSQxEPucrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 01:40:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<nF3VSgxEpoWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 01:45:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=</RpFXAxEAoUvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 01:46:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<J8XKYAxEfNln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 01:46:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<WtJiYAxEHpMv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 01:49:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<65MfaQxEJt1noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 01:51:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<BJmtcQxEfMekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 01:52:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<uUC5dAxE1KoI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.123
country_id: 6252001
description:
Nov 21 01:52:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<b1jgdQxEm8yTuYR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 01:53:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kl5BdwxESJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 01:54:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<hjOBfQxEatIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-21 01:55:12 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:50836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 01:55:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<6fNgfgxELIGElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-11-21 01:55:23 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:59370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 01:56:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<EfoHgwxEBuJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 01:58:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<AsjjiAxEYqVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 01:59:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<a1jbjQxE7MAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:02:27 host2 sshd[1835619]: Disconnected from invalid user user 69.5.13.70 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:03:01 host2 sshd[1835935]: Disconnected from invalid user superset 152.32.185.214 port 34978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.182.245
country_id: 2921044
description:
Nov 21 02:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.182.245, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</DgXmwxE0oOkXLb1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 02:05:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<uxG0oQxEwtAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 02:05:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<Xi3LoQxEloFe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 02:05:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<o6YSogxELkSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:05:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<LIwkogxEYqItTeM5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:06:39 host2 sshd[1838939]: Disconnected from invalid user eric 152.32.185.214 port 56538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.196
country_id: 798544
description:
Nov 21 02:06:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=91.240.44.196, lip=66.85.158.91, TLS, session=<f2HNpAxEUdhb8CzE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.10.197.189
country_id: 3469034
description:
Nov 21 02:06:32 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.10.197.189, lip=66.85.158.91, TLS, session=<dEnmpQxEXsOxCsW9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:07:52 host2 sshd[1839689]: Disconnected from invalid user cps 69.5.13.70 port 54286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:07:51 host2 sshd[1839672]: Disconnected from invalid user karthik 152.32.185.214 port 49710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 02:08:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<24WQrgxEyNwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 02:08:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<ITnqrgxExrKl0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 21 02:09:03 host2 sshd[1840619]: Disconnected from invalid user victor 152.32.185.214 port 50944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:09:33 host2 sshd[1840976]: Disconnected from invalid user repository 51.83.46.40 port 38544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 02:10:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gBtcswxE9MGKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:10:31 host2 sshd[1841792]: Disconnected from invalid user ubuntu 92.207.4.157 port 54468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:10:33 host2 sshd[1841890]: Disconnected from invalid user user 69.5.13.70 port 45500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:10:36 host2 sshd[1841933]: Disconnected from invalid user admin 46.249.101.120 port 50026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:10:39 host2 sshd[1841999]: Disconnected from invalid user srv 51.83.46.40 port 51982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.22
country_id: 6252001
description:
Nov 21 02:10:30 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+akttQxEE83N0h8W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:11:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<M5Q7ugxEYLIrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.13.70
country_id: 1643084
description:
Nov 21 02:11:56 host2 sshd[1842745]: Disconnected from invalid user ricardo 69.5.13.70 port 39672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 02:13:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oPh0vgxEyrgXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:13:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XJo9wAxEgNErmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:13:58 host2 sshd[1844642]: Disconnected from invalid user tom 92.207.4.157 port 34094 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 02:14:29 host2 sshd[1845047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:15:57 host2 sshd[1846261]: Disconnected from invalid user george 51.83.46.40 port 52550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 02:16:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<1yvmyAxEqtmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:15:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<DzeuxgxEyKctTeM5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-21 02:18:34 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:55654: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:18:39 host2 sshd[1848172]: Disconnected from invalid user parking 92.207.4.157 port 44572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-21 02:18:51 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:54980: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:20:17 host2 sshd[1849400]: Disconnected from invalid user nfsuser 46.249.101.120 port 38304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 21 02:21:22 host2 sshd[1850136]: Disconnected from invalid user xmr 92.207.4.157 port 49812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Nov 21 02:21:11 host2 sshd[1850030]: Disconnected from invalid user tom 51.83.46.40 port 60476 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 02:25:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<qEAX6QxEyNtm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:24:10 host2 sshd[1852149]: Disconnected from invalid user username 46.249.101.120 port 59186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 02:24:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<M4k35gxEZpkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 02:24:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<uhLZ5gxEspov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 02:25:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mcic6QxEyKeYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Nov 21 02:25:46 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hMzH6wxE0tqTuYRG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 02:26:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<w1po7wxE+LYrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.6
country_id: 6252001
description:
Nov 21 02:27:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.6, lip=66.85.158.92, session=<etnB8QxEjrSH7X4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:28:05 host2 sshd[1854834]: Disconnected from invalid user hari 46.249.101.120 port 50128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 02:29:51 host2 sshd[1855858]: Disconnected from invalid user emmett 62.60.131.157 port 35923 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 02:31:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<qI/MAA1E9K0vWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.12
country_id: 2510769
description:
Nov 21 02:32:18 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 44 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=185.214.138.12, lip=66.85.158.91, TLS, session=<r7qPAA1E35u51ooM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 02:32:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<3dMqAw1EHp2SOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.101
country_id: 6252001
description:
Nov 21 02:32:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.101, lip=66.85.158.91, session=<SZWFAw1EPPfG6xhl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 02:32:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<H/2hBA1Ezrkv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.48
country_id: 3469034
description:
Nov 21 02:33:00 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=177.71.89.48, lip=66.85.158.91, TLS, session=<ePCLBA1Edc6xR1kw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 02:34:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<C4BXDA1Efpsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 02:34:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Q/fjCg1EAoykXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.211
country_id: 3017382
description:
Nov 21 02:35:33 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.211, lip=66.85.158.91, TLS: Connection closed, session=</pPADg1E1elb51nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.209
country_id: 3017382
description:
Nov 21 02:35:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.209, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zi+ZDw1EVaNb51nR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.213
country_id: 3017382
description:
Nov 21 02:35:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.213, lip=66.85.158.91, TLS: Connection closed, session=<dSXJDw1Etdxb51nV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.214
country_id: 3017382
description:
Nov 21 02:35:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<trEgDg1EhZVb51nW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 02:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<XNJJDg1EfJdnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 02:35:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wZ1LDg1E8JFn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.249.101.120
country_id: 2921044
description:
Nov 21 02:37:39 host2 sshd[1861306]: Disconnected from invalid user frappe 46.249.101.120 port 55672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 02:37:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1C1dFg1EQNoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 02:37:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<hjBUFw1EiIeElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 02:39:32 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65377: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 02:41:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3QHgIg1EtqQv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.213
country_id: 6252001
description:
Nov 21 02:41:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.185.213, lip=66.85.158.91, session=<UIhiJQ1ETIgofLnV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 02:41:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E87cIg1EUIYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 02:42:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<1NRXKA1E8NBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 02:44:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<51FnLg1EOJBnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:46:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<IBvfNA1EHK0tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 02:48:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<DxiHPg1E7OQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 02:50:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ZAZ9RA1EJOmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 02:53:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<MRMXTg1EeJGKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Nov 21 02:53:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<vTxnTQ1EZ6yy2B4b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.239.77.14
country_id: 3996063
description:
Nov 21 02:53:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=45.239.77.14, lip=66.85.158.91, TLS, session=<a8KWTg1Ez+Qt700O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 02:56:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<ufbwWQ1EiF8tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.209.18.9
country_id: 2750405
description:
Nov 21 02:59:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=94.209.18.9, lip=66.85.158.91, session=<l/IMZA1ECORe0RIJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 02:59:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<EfDFZQ1EdtMrmxBp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 03:00:57 host2 sshd[1876710]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 03:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<VXvBaQ1Eopal0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:01:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<14u+aw1EBogrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 03:02:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<USa2bg1EXouLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 03:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<qKSQig1EmJqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 03:10:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<sXw1jA1EjJkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:10:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<xmFgjQ1E8Mov/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 03:13:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<WWmqlg1Ejthm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 03:13:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<M6Rtlw1EgogrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.48.21
country_id: 2963597
description:
Nov 21 03:15:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=37.203.48.21, lip=66.85.158.91, TLS, session=<32I6nA1EmZ4lyzAV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.1.96
country_id: 2215636
description:
Nov 21 03:15:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=5.63.1.96, lip=66.85.158.91, TLS, session=<o7ltnQ1Ek8IFPwFg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.128.219
country_id: 3469034
description:
Nov 21 03:17:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.92.128.219, lip=66.85.158.91, TLS, session=<1c0hog1EUcuxXIDb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:16:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xNefog1EZucv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 03:17:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<hrMZpA1E3rUFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.174
country_id: 953987
description:
Nov 21 03:17:25 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=102.129.63.174, lip=66.85.158.91, TLS, session=<zZJZow1EzshmgT+u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 03:18:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<RiX0pg1E4NYvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 03:18:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<CdJYpw1EvJGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 03:19:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<wGiQqg1ECsgv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 03:21:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<bXlfsQ1E2MSElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 03:22:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<y2STtQ1EguZnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Nov 21 03:22:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5Flntg1Ezt7N0h83>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:23:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ToeGuQ1ENuwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 03:23:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<zwd/uQ1Efp0I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 03:24:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6nxgvA1E1LVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-11-21 03:27:24 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:56454: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-21 03:27:41 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:51276: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 03:27:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<N+4uyg1EvkMtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:28:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jvZWyg1E4tMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 03:29:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<lu770A1EzOVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 03:31:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<Lnj41Q1EKMRnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 03:33:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<DE/33A1ErpItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-11-21 03:34:04 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:65304: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-21 03:34:18 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61469: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 03:36:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<m3OI6A1EeLmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 03:36:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yQ6U6Q1EftCKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 03:38:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<w+dy7w1ENGstTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 03:40:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DPPK9g1EtuwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 21 03:44:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=<noWZBQ5EhMMtQ5ts>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.106
country_id: 2510769
description:
Nov 21 03:45:09 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=139.28.190.106, lip=66.85.158.91, TLS, session=<26OtBg5E1+iLHL5q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:48:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DbdyEg5E3MIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 03:49:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<hiqvFQ5EapeLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 03:49:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<5w11GA5E+skrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 03:53:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<WAHpJQ5E5I2l0iHB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 03:55:29 host2 sshd[1913696]: Disconnected from invalid user temp 194.107.115.2 port 27150 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 03:55:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<MXR+LQ5EQKCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 03:56:41 host2 sshd[1915186]: Disconnected from invalid user test 204.216.111.140 port 26414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 03:57:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gaxUMw5EqpkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 03:57:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ci82NQ5EaqIv/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 03:58:58 host2 sshd[1917714]: Disconnected from invalid user spectrum 194.107.115.2 port 35604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 03:59:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eiVLOQ5EgIkv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.121.27.236
country_id: 3469034
description:
Nov 21 03:59:42 host2 sshd[1918535]: Disconnected from invalid user test 191.121.27.236 port 49212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov 21 04:00:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<C1tBPw5E5s9IPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 04:00:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<joVZPw5E1MgrpAFm>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.195
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.195: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 04:01:18 host2 sshd[1920402]: Disconnected from invalid user test 194.107.115.2 port 34200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-11-21 04:01:54 dovecot_login authenticator failed for ([121.73.163.22]) [121.73.163.22]:53406: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 04:02:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<JnALRA5Efptm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 04:02:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AmYiRQ5EvOakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 04:04:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<PXjASw5ENOuElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:04:26 host2 sshd[1923762]: Disconnected from invalid user dev 154.88.2.70 port 60370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 04:04:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<1acYTQ5EjJEvWfqZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 04:04:53 host2 sshd[1923974]: Disconnected from invalid user i 204.216.111.140 port 8762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 04:05:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dK4ZUA5E5Lwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 04:05:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<4pbBUA5EVugv+yzS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:07:00 host2 sshd[1926782]: Disconnected from invalid user extern 200.91.236.125 port 57198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.121.27.236
country_id: 3469034
description:
Nov 21 04:07:41 host2 sshd[1927741]: Disconnected from invalid user musicbot 191.121.27.236 port 34842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Nov 21 04:07:12 host2 sshd[1927064]: Disconnected from invalid user i 194.107.115.2 port 58928 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 04:08:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<5SerWw5ENM4I04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 04:09:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<HRP3XA5EgMxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:09:02 host2 sshd[1929082]: Disconnected from invalid user victor 154.88.2.70 port 56634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:09:55 host2 sshd[1929872]: Disconnected from invalid user miguel 103.161.207.2 port 44960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:10:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<nyO2YA5EJpstTeM5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 04:10:39 host2 sshd[1930906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 204.216.111.140
country_id: 6251999
description:
Nov 21 04:10:54 host2 sshd[1931159]: Disconnected from invalid user nrk 204.216.111.140 port 28448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 21 04:11:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<7/7FZA5E0KEFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.100.201
country_id: 798544
description:
Nov 21 04:13:22 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.100.201, lip=66.85.158.91, TLS, session=<Vy+caw5EhOKy22TJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.61.207.31
country_id: 2510769
description:
Nov 21 04:14:34 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=5.61.207.31, lip=66.85.158.91, TLS, session=<BM/Ubw5E2J0FPc8f>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:14:57 host2 sshd[1935901]: Disconnected from invalid user ahsan 154.88.2.70 port 40030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.118
country_id: 3469034
description:
Nov 21 04:14:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art>, method=PLAIN, rip=187.120.73.118, lip=66.85.158.91, TLS, session=<daodcQ5EyqO7eEl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:15:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<wuJicg5EJqsv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:16:35 host2 sshd[1938078]: Disconnected from invalid user ctl 103.161.207.2 port 39902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 04:18:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<7UlffQ5EqsxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 04:17:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<zkxEeg5EvuJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 04:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<Jzxpew5E6KctPZWl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 04:17:47 host2 sshd[1939116]: Disconnected from invalid user jakayla 62.60.131.157 port 57726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:17:53 host2 sshd[1939184]: Disconnected from invalid user dev 103.161.207.2 port 38886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 04:20:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<z+KxhA5EjKGKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Nov 21 04:19:09 host2 sshd[1939963]: Disconnected from invalid user extern 103.161.207.2 port 37870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:19:15 host2 sshd[1940085]: Disconnected from invalid user ctl 200.91.236.125 port 48726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Nov 21 04:19:37 host2 sshd[1940478]: Disconnected from invalid user tempuser 154.88.2.70 port 48770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:19:59 host2 sshd[1940853]: Disconnected from invalid user testuser 185.141.132.26 port 48644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Nov 21 04:20:29 host2 sshd[1941663]: Disconnected from invalid user dev 200.91.236.125 port 37506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:20:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<UnVthw5E9tYtTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:21:11 host2 sshd[1942208]: Disconnected from invalid user school 45.172.152.74 port 44808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 04:22:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<EQZWjQ5EroqYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:22:39 host2 sshd[1945361]: Disconnected from invalid user richard 87.239.250.247 port 21376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:23:30 host2 sshd[1945756]: Disconnected from invalid user admin 45.78.229.174 port 39486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:23:44 host2 sshd[1945927]: Disconnected from invalid user koha 45.172.152.74 port 58798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-21 04:24:54 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:38123: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:24:40 host2 sshd[1946368]: Disconnected from invalid user amin 87.239.250.247 port 57606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:24:54 host2 sshd[1946489]: Disconnected from invalid user user 45.172.152.74 port 48546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:25:15 host2 sshd[1946821]: Disconnected from invalid user repository 185.141.132.26 port 48958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-21 04:25:29 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:38427: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.40.126
country_id: 6252001
description:
[2025-11-21 04:26:09 +0530] info [whostmgrd] 184.164.40.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:28:03 host2 sshd[1948373]: Disconnected from invalid user gituser 185.141.132.26 port 56262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Nov 21 04:28:35 host2 sshd[1948746]: Disconnected from invalid user network 45.172.152.74 port 60682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-21 04:29:35 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:53156: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-11-21 04:29:47 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:50379: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.141.132.26
country_id: 130758
description:
Nov 21 04:29:32 host2 sshd[1949290]: Disconnected from invalid user clouduser 185.141.132.26 port 59840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:31:36 host2 sshd[1950674]: Disconnected from invalid user isaac 45.78.229.174 port 38418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:32:38 host2 sshd[1951281]: Disconnected from invalid user ftpuser 87.239.250.247 port 48768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-11-21 04:33:09 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:49563: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:34:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<eXE6tw5E1istTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:34:41 host2 sshd[1952473]: Disconnected from invalid user nico 87.239.250.247 port 61416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 04:36:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<HXeWvQ5E5pSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 04:36:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<lJ2rwA5ETqormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 04:37:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<41UOxA5E4pkzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:38:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lbWQxA5E0tUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 04:38:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<xWy0xg5EgssrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 04:40:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SfhkzA5EuoCYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.239.250.247
country_id: 2750405
description:
Nov 21 04:40:41 host2 sshd[1956131]: Disconnected from invalid user deployer 87.239.250.247 port 11994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.246
country_id: 3469034
description:
Nov 21 04:42:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@casa18villa.com>, method=PLAIN, rip=191.53.107.246, lip=66.85.158.91, TLS, session=<tcu20w5E1+i/NWv2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.243
country_id: 99237
description:
Nov 21 04:42:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.150.243, lip=66.85.158.91, TLS, session=<t4711A5EBJtBFJbz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-21 04:45:06 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:46716: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.155
country_id: 1819730
description:
2025-11-21 04:45:32 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:50532: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:45:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<fpw44A5EXoAv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 04:46:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<w4Bz5A5EBrWkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 04:46:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<vllL4g5E9pWl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-11-21 04:46:22 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:45600: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-21 04:46:47 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:46410: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 04:47:32 host2 sshd[1961227]: Disconnected from invalid user won 45.78.229.174 port 34410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 04:47:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<H6E/6A5EvpsrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.83.214
country_id: 6252001
description:
Nov 21 04:48:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.83.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ztfy6g5EppEUqVPW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-21 04:49:19 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:57623: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-21 04:49:36 dovecot_login authenticator failed for ([179.185.29.233]) [179.185.29.233]:53834: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 04:50:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<gfyS8g5EhLovWfqZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.111
country_id: 6252001
description:
Nov 21 04:51:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gCFI8w5ErsnN0h9v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 04:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ThFl8Q5EnM5m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 04:52:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<M3uj9g5EouUtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 04:52:28 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<nglL+A5E0ocv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 04:54:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<V3V5/g5EQpEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Nov 21 04:55:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@essenceceylontea.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<IBqtAQ9EDuMv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.99.43
country_id: 6252001
description:
Nov 21 04:55:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.99.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yLvqAg9ECrYoTGMr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 04:55:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<tY6bAw9E8JkzTY0d>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 04:57:07 host2 sshd[1969417]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 04:56:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<XB8rBg9E6MlnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 04:57:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1LTrCw9EtJ+YNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.174
country_id: 1880251
description:
Nov 21 05:00:52 host2 sshd[1971876]: Disconnected from invalid user zero 45.78.229.174 port 46530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 05:01:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<hl79GA9E+sBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 05:02:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<5WnvGg9ESowtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 05:04:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<IzUbJA9ESuVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 05:05:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ywE3Jw9EjJRnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 05:08:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<IcyxMg9EYlyYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.18.253.210
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.18.253.210 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 05:10:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<svUmOQ9EhLAv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 21 05:11:39 host2 sshd[1978990]: Disconnected from invalid user test1 128.1.132.137 port 53844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 05:12:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<QLRzQA9ECtCElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.137.61
country_id: 798544
description:
Nov 21 05:14:25 host2 sshd[1980658]: Disconnected from invalid user keycloak 51.68.137.61 port 39138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 21 05:14:29 host2 sshd[1980686]: Disconnected from invalid user support 128.1.132.137 port 41330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.59
country_id: 1269750
description:
Nov 21 05:14:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=202.136.85.59, lip=66.85.158.91, TLS, session=<fvToRw9E9+fKiFU7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.192.67.43
country_id: 3077311
description:
Nov 21 05:15:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.192.67.43, lip=66.85.158.91, TLS, session=<5R8LSQ9E4AkfwEMr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.210.82
country_id: 130758
description:
Nov 21 05:15:24 host2 sshd[1981302]: Disconnected from invalid user keycloak 62.60.210.82 port 52464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 21 05:16:00 host2 sshd[1981601]: Disconnected from invalid user user123 128.1.132.137 port 53518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.72.42.125
country_id: 3175395
description:
Nov 21 05:16:52 host2 sshd[1982090]: Disconnected from invalid user deploy 185.72.42.125 port 54192 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 05:17:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<c0UOUA9Ezr8v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.212.123
country_id: 6251999
description:
Nov 21 05:17:50 host2 sshd[1982701]: Disconnected from invalid user deploy 158.69.212.123 port 49288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.137.61
country_id: 798544
description:
Nov 21 05:18:50 host2 sshd[1983141]: Disconnected from invalid user robot 51.68.137.61 port 53280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.137.61
country_id: 798544
description:
Nov 21 05:19:56 host2 sshd[1983621]: Disconnected from invalid user odoo 51.68.137.61 port 33418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 05:21:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<viQXYA9ErNIXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.212.123
country_id: 6251999
description:
Nov 21 05:22:31 host2 sshd[1985292]: Disconnected from invalid user abi 158.69.212.123 port 37732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 05:23:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<b/itZQ9EGNeLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.72.42.125
country_id: 3175395
description:
Nov 21 05:23:21 host2 sshd[1985820]: Disconnected from invalid user katie 185.72.42.125 port 45572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 05:23:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<nk/mZg9EcIItTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 21 05:23:32 host2 sshd[1985889]: Disconnected from invalid user antonio 128.1.132.137 port 55202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.212.123
country_id: 6251999
description:
Nov 21 05:24:34 host2 sshd[1986472]: Disconnected from invalid user janus 158.69.212.123 port 46890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 05:26:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<U14Ocg9EnKkrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.35.141
country_id: 298795
description:
Nov 21 05:26:49 host2 sshd[1988062]: Disconnected from invalid user vas 101.44.35.141 port 40432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 05:27:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<XlmodA9E+sWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.210.82
country_id: 130758
description:
Nov 21 05:28:41 host2 sshd[1989101]: Disconnected from invalid user frappe 62.60.210.82 port 36582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 05:28:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<fuNDeA9ESIArmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.72.42.125
country_id: 3175395
description:
Nov 21 05:29:27 host2 sshd[1989506]: Disconnected from invalid user magento 185.72.42.125 port 49962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.44.35.141
country_id: 298795
description:
Nov 21 05:30:23 host2 sshd[1990155]: Disconnected from invalid user desliga 101.44.35.141 port 52290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 05:32:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<tmF1hg9EOJSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 05:32:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<k6HfiA9EjsaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 05:35:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<NzPZkA9EolYtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 05:35:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<I/cykw9EWN4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 05:38:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<E9NImw9EcOMvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.152
country_id: 3469034
description:
Nov 21 05:40:07 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art>, method=PLAIN, rip=177.44.96.152, lip=66.85.158.91, TLS, session=<Je+soQ9EhNqxLGCY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 05:39:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<A7UZoA9EHoWl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 05:39:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<hWZBoA9E5qgv+yzS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.49
country_id: 6252001
description:
Nov 21 05:39:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.49, lip=66.85.158.92, TLS: Connection closed, session=</lKuoA9E/IOnXpIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.4.81
country_id: 2300660
description:
Nov 21 05:39:45 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=41.139.4.81, lip=66.85.158.91, TLS, session=<MT9poA9EOa8piwRR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 05:39:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<zOK+oA9EEMpm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 05:40:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VbeRog9EtsMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 05:41:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Camfpw9EGJozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 05:42:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ctPZqg9E5LyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 05:44:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<lUwGsw9EcutnoNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-11-21 05:44:56 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:56244: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-21 05:45:13 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:47290: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 05:46:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<ZDQluw9EAMUtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.24
country_id: 2186224
description:
2025-11-21 05:49:02 dovecot_login authenticator failed for ([121.73.160.24]) [121.73.160.24]:44784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.253.99
country_id: 3865483
description:
Nov 21 05:49:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=200.229.253.99, lip=66.85.158.91, TLS, session=<V318xA9EJ+nI5f1j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-11-21 05:49:55 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:36125: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.140.123.15
country_id: 6290252
description:
Nov 21 05:49:19 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=95.140.123.15, lip=66.85.158.91, TLS, session=<+me8wg9EFOFfjHsP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-21 05:49:20 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:41978: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 05:50:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uem8yA9EctRn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.73.202.38
country_id: 6252001
description:
Nov 21 05:50:58 host2 sshd[2003165]: Disconnected from invalid user vpn 208.73.202.38 port 57384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 208.73.202.38
country_id: 6252001
description:
Nov 21 05:52:10 host2 sshd[2003793]: Disconnected from invalid user nia 208.73.202.38 port 49560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 21 05:52:40 host2 sshd[2004129]: Disconnected from invalid user felipe 103.179.57.150 port 50638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 05:52:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<SsO9zw9EwI5K4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.73.202.38
country_id: 6252001
description:
Nov 21 05:53:16 host2 sshd[2004483]: Disconnected from invalid user manage 208.73.202.38 port 54180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 05:53:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<X2wf1A9EQt4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 05:53:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<p1M91A9E+LpnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.73.202.38
country_id: 6252001
description:
Nov 21 05:55:26 host2 sshd[2006244]: Disconnected from invalid user ca 208.73.202.38 port 50786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 05:55:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<0Wbr2A9EVC+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 05:56:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Z+E73A9EaqaElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 21 05:59:04 host2 sshd[2008173]: Disconnected from invalid user ca 103.179.57.150 port 59256 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 06:00:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E/P06g9EgsAv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 21 06:01:11 host2 sshd[2009700]: Disconnected from invalid user guest 103.179.57.150 port 52488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.12.118.74
country_id: 3469034
description:
Nov 21 06:05:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.12.118.74, lip=66.85.158.91, TLS, session=<mTsV+w9EGpKxDHZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.131
country_id: 3865483
description:
Nov 21 06:05:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=45.238.106.131, lip=66.85.158.91, TLS, session=<MgHf/A9EG9wt7mqD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 06:06:51 host2 sshd[2013228]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 06:06:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<oLFcAhBEBm4tTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Nov 21 06:07:51 host2 sshd[2013683]: Disconnected from invalid user manage 103.179.57.150 port 35464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 06:10:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<8TdQDhBEDJaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 06:10:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lBsfEBBERMyLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-21 06:11:02 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:47898: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-11-21 06:11:26 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:42038: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 21 06:15:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<2WC1HxBEC6LOvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.63.181
country_id: 2921044
description:
Nov 21 06:15:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=206.189.63.181, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6htxIBBEATPOvT+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.242
country_id: 2921044
description:
Nov 21 06:15:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.172.179.242, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kLDOIRBE2FGnrLPy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 06:16:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<BxC5IxBEOsUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 06:16:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<+PUDJRBEEOGkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 06:17:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<G6ufKBBE0LgtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.255
country_id: 3175395
description:
Nov 21 06:17:36 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=171.22.233.255, lip=66.85.158.91, TLS, session=<OFLeJxBEiIWrFun/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 06:17:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<ocXsKRBEAJwrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.246
country_id: 226074
description:
Nov 21 06:17:59 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.107.246, lip=66.85.158.91, TLS, session=<ITIRKRBEMdHEAGv2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 06:23:04 host2 sshd[2022908]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 06:23:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vc7ZPRBEvrIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 06:25:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<D6/AQxBEGp4vWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 06:25:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PjSHRhBE6IcI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 06:25:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63850: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 06:26:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<8XjRRxBEOrov+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 06:26:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<BTFJSRBE2OaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 06:28:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<02//TRBETJozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 06:28:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ekMHURBEwJhm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 06:31:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<EVeJWxBE8LotPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.191.236.201
country_id: 3469034
description:
Nov 21 06:32:56 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.191.236.201, lip=66.85.158.91, TLS, session=<ZBCwXhBEkcstv+zJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 06:33:02 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<3Z74XxBEBsSl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.192.195.122
country_id: 6252001
description:
2025-11-21 06:33:07 dovecot_login authenticator failed for ([72.192.195.122]) [72.192.195.122]:60226: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Nov 21 06:33:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, TLS, session=<J/xGYBBE6OXN0h9s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.3.225
country_id: 1880251
description:
Nov 21 06:32:21 host2 sshd[2029015]: Disconnected from invalid user sagar 47.237.3.225 port 58546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 06:32:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<QR/fXhBE8JNnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.42
country_id: 298795
description:
Nov 21 06:33:14 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<K/fSXxBEYb5fAKsq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-21 06:33:24 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:63844: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:35:45 host2 sshd[2031224]: Disconnected from invalid user ubuntu 107.175.228.153 port 58140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 06:36:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eV4kbBBEqIov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:38:46 host2 sshd[2033022]: Disconnected from invalid user user1 37.255.249.201 port 44880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 06:39:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<hY6ReBBEKIKElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:39:55 host2 sshd[2033752]: Disconnected from invalid user blog 107.175.228.153 port 42786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 06:40:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<YKUkfBBEVJtK4fqm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.228.153
country_id: 6252001
description:
Nov 21 06:41:02 host2 sshd[2034631]: Disconnected from invalid user sagar 107.175.228.153 port 37418 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.8
country_id: 6252001
description:
Nov 21 06:41:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.230.168.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<O3DJfBBEm51b5qgI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 06:40:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9QOGeRBEJsZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 06:41:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<6ez/fxBE1OtnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 06:41:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<IN1QfRBEmNeYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.9
country_id: 6252001
description:
Nov 21 06:41:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.9, lip=66.85.158.91, TLS: Connection closed, session=<NTZxfRBEfaBb5qgJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Nov 21 06:41:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.230.168.1, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wEX7fRBEl8Vb5qgB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.12
country_id: 6252001
description:
Nov 21 06:41:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.12, lip=66.85.158.91, TLS: Connection closed, session=<W8YpfhBEfeVb5qgM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 06:42:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Z/6LgxBE4pMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:44:52 host2 sshd[2036935]: Disconnected from invalid user nexus 37.255.249.201 port 44114 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.204
country_id: 2635167
description:
Nov 21 06:45:46 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS, session=<+XWbjRBEwc9X7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.24
country_id: 2635167
description:
Nov 21 06:45:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4++rjRBEYZlX7LAY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:46:44 host2 sshd[2038631]: Disconnected from invalid user david 87.201.127.149 port 35164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.18
country_id: 2635167
description:
Nov 21 06:46:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.18, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<CWiojxBEpdS594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.13
country_id: 2635167
description:
Nov 21 06:46:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1uOmkRBEc8y594kN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.31
country_id: 1643084
description:
Nov 21 06:46:55 host2 sshd[2038712]: Disconnected from invalid user ubuntu 103.179.57.31 port 52658 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.10
country_id: 2635167
description:
Nov 21 06:47:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.10, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<egGjkxBEdcm594kK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:47:34 host2 sshd[2039091]: Disconnected from invalid user dev 154.83.15.92 port 52746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Nov 21 06:48:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<pBiglRBE26y594kQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:48:07 host2 sshd[2039363]: Disconnected from invalid user andrew 41.111.162.34 port 6548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.10
country_id: 2635167
description:
Nov 21 06:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.10, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Nx2amRBEbby594kK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.27
country_id: 2635167
description:
Nov 21 06:48:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.27, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cEGalxBEZ+u594kb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:48:58 host2 sshd[2039749]: Disconnected from invalid user boot 154.83.15.92 port 52678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:49:23 host2 sshd[2039997]: Disconnected from invalid user ubuntu 87.201.127.149 port 47784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.7
country_id: 2635167
description:
Nov 21 06:49:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.7, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RgqXmxBEwbW594kH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 06:49:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<lkSUmxBELEgtTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:49:51 host2 sshd[2040094]: Disconnected from invalid user pt 37.255.249.201 port 57812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:50:03 host2 sshd[2040359]: Disconnected from invalid user hsadmin 57.129.74.123 port 38444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:50:34 host2 sshd[2040712]: Disconnected from invalid user test1 41.111.162.34 port 28444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Nov 21 06:50:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<NnCOnxBEudJX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.16
country_id: 2635167
description:
Nov 21 06:50:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<xGKRnRBEj9y594kQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.92
country_id: 1819730
description:
Nov 21 06:50:23 host2 sshd[2040638]: Disconnected from invalid user ubuntu 154.83.15.92 port 52628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:51:18 host2 sshd[2041051]: Disconnected from invalid user ray 5.182.83.231 port 57572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:51:30 host2 sshd[2041151]: Disconnected from invalid user syp 37.255.249.201 port 51264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:51:46 host2 sshd[2041254]: Disconnected from invalid user cod2server 156.238.252.133 port 33656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov 21 06:53:03 host2 sshd[2041857]: Disconnected from invalid user newuser 37.255.249.201 port 48786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:53:05 host2 sshd[2041886]: Disconnected from invalid user mihail 41.111.162.34 port 4982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.201.127.149
country_id: 290557
description:
Nov 21 06:52:29 host2 sshd[2041590]: Disconnected from invalid user boot 87.201.127.149 port 55490 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 06:53:23 host2 sshd[2042079]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.31
country_id: 1643084
description:
Nov 21 06:53:25 host2 sshd[2042121]: Disconnected from invalid user sinusbot 103.179.57.31 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:53:33 host2 sshd[2042257]: Disconnected from invalid user metabase 5.182.83.231 port 36752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:53:57 host2 sshd[2042389]: Disconnected from invalid user rise 156.238.252.133 port 57480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 06:53:23 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<EaXEqBBERNeKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 06:54:18 host2 sshd[2042778]: Disconnected from invalid user andrew 157.245.49.180 port 44334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 21 06:54:31 host2 sshd[2043322]: Disconnected from invalid user pc 41.111.162.34 port 51290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Nov 21 06:55:03 host2 sshd[2043686]: Disconnected from invalid user john 156.238.252.133 port 41178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:55:30 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<Ev9tsBBEQIcDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:56:29 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<f5P1sxBE4oIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:57:14 host2 sshd[2044920]: Disconnected from invalid user ipfs 57.129.74.123 port 9308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Nov 21 06:58:01 host2 sshd[2045309]: Disconnected from invalid user support 5.182.83.231 port 43426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Nov 21 06:58:15 host2 sshd[2045486]: Disconnected from invalid user elastic 57.129.74.123 port 37438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 06:59:54 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<ZzgxwBBE4LcDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 06:59:56 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<bfwnwBBE8KiLO0qU>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:00:35 host2 dovecot[3366982]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<om2bwhBE2okDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 07:01:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<gt4JxBBE5L2kXF7M>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.13
country_id: 1605651
description:
Nov 21 07:01:06 host2 pure-ftpd[2047116]: (?@103.176.152.13) [INFO] New connection from 103.176.152.13


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:00:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<MKR0wRBEXkwtTeM5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:00:31 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<gZNZwhBEOIIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:02:03 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<YQLixxBEJK4Dg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:01:43 host2 sshd[2047399]: Disconnected from invalid user test-user 157.245.49.180 port 33916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 07:03:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<QsniyxBEbr6SOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:05:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<4vt71RBEQqUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:07:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<UbGQ2xBEopQrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-21 07:10:35 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:38478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-21 07:10:51 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:33779: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-21 07:10:58 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:33649: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.132.29.166
country_id: 2233387
description:
2025-11-21 07:11:22 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [102.132.29.166]:56500: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.42
country_id: 6252001
description:
Nov 21 07:11:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.42, lip=66.85.158.92, TLS, session=<0sNt6RBEEvLG6xgq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-21 07:11:42 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:51582: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 07:11:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<nhGB6hBEaLsI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-21 07:11:55 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:49310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 07:11:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<NYuR6BBErNCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 07:11:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<yRPo6BBEqogrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 07:12:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<BogJ7RBECMcvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 07:13:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<07wt8BBEmscv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 07:14:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<Poi39RBEhJozTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:15:04 host2 sshd[2055223]: Disconnected from invalid user test001 157.245.49.180 port 38700 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.112
country_id: 6252001
description:
Nov 21 07:16:27 host2 pure-ftpd[2056076]: (?@20.65.194.112) [INFO] New connection from 20.65.194.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 07:16:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<9cF2/BBEoI4tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 07:17:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<niRR/hBE3uhm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:18:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<QqQkBBFEctgDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 07:19:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Kw8mBhFEfIwv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:20:36 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<MScxChFEXLsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 07:20:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4JTAChFErI5noNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:22:23 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<zTeaEBFEqsEDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 21 07:22:37 host2 sshd[2059389]: Disconnected from invalid user leonardo 157.245.49.180 port 49434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:23:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<MVFLFRFE0twDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 07:23:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<z1pbFRFElNCElIx5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:24:28 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<zxMLGBFEPtQDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:24:58 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<ETDSGRFEZpIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:25:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<pVHOGxFEVrsDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 07:26:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WWBwHRFERJEv/AU1>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:26:47 host2 dovecot[3366982]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eh9KIBFENuMDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.33
country_id: 6252001
description:
Nov 21 07:26:52 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.33, lip=66.85.158.91, TLS, session=<HPWfIBFEIuvN0h8h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 07:26:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<Jm2lIBFEvKql0iHB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:27:16 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<N9MOIhFE4ukDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 07:27:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<NkttIhFELqqYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 21 07:28:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<uPeaJxFEThNBMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 21 07:28:55 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<eSv1JxFEwKIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 21 07:29:15 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<oCMjKRFE4CNBMQGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 07:29:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<D6CkKRFEsKJK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 07:29:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<RkxmKhFEsMxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 07:29:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ZXiCKxFEcuNnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.134.101
country_id: 2921044
description:
Nov 21 07:31:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.227.134.101, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bQulMBFEvpel44Zl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:31:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<w3XQMhFEhpctTeM5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:33:41 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.20, lip=66.85.158.91, session=<ZBP4OBFExKalmncU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:34:53 host2 dovecot[3366982]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=165.154.119.20, lip=66.85.158.92, session=<inRIPRFEbNWlmncU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.220
country_id: 1269750
description:
Nov 21 07:35:05 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=45.118.34.220, lip=66.85.158.91, TLS, session=<Ra3iPBFEY9MtdiLc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.119.20
country_id: 1605651
description:
Nov 21 07:35:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=165.154.119.20, lip=66.85.158.92, session=<UNhkPhFEdtWlmncU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.243
country_id: 3469034
description:
Nov 21 07:35:26 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.199.243, lip=66.85.158.91, TLS, session=<6o0jPhFEjuazvcfz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 07:36:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<T0ibQxFEjKmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.128
country_id: 3469034
description:
Nov 21 07:36:44 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=186.209.247.128, lip=66.85.158.91, TLS, session=<QxGqQhFEQOy60feA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.135.211
country_id: 1269750
description:
Nov 21 07:37:03 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=103.59.135.211, lip=66.85.158.91, TLS, session=<3n/9QxFE1MhnO4fT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 07:42:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<dAmyWBFEHqQtTeM5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.74
country_id: 2635167
description:
Nov 21 07:43:30 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.74, lip=66.85.158.91, TLS, session=<wF4WXBFESdq594lK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 07:45:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<HgUWZBFEfqikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 07:47:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ik2dahFE3I6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-11-21 07:53:13 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:51389: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-21 07:53:29 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:58387: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Nov 21 07:53:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.26, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<nrHJgBFEZvei2JYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:55:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<uBtihhFEdrUrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 07:56:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<yZ9+iRFEXMeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 07:57:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<f1yVjBFEqrkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 07:57:53 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<849ijxFEcoEI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.208.45
country_id: 6251999
description:
Nov 21 07:58:34 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=148.113.208.45, lip=66.85.158.92, TLS, session=<zhP3kRFEKoWUcdAt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Nov 21 07:58:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.26, lip=66.85.158.91, TLS, session=<fmx/khFEavGi2JYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 07:58:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<SiuOkhFEtMsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 07:59:15 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<N/1MlBFEsoEvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 08:00:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<VlrQmBFEquAv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 08:01:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<COzJnBFEwJozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:02:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pKqXoBFEGskv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 08:02:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<vDrknhFEXL4tPZWl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 08:03:13 host2 sshd[2082024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.234.180.75
country_id: 3865483
description:
Nov 21 08:04:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 31 secs): user=<info@casa18villa.com>, method=PLAIN, rip=45.234.180.75, lip=66.85.158.91, TLS, session=<0eKyoxFEF+st6rRL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.96
country_id: 1269750
description:
Nov 21 08:04:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.18.166.96, lip=66.85.158.91, TLS, session=<4lahpRFEIpJnEqZg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 08:05:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<paB3qxFExqJm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 08:07:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<U/F3sBFE1KWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:08:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vvojthFECM9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:09:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OeUAuBFEfsIv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.216
country_id: 6252001
description:
Nov 21 08:12:01 host2 pure-ftpd[2088073]: (?@205.210.31.216) [INFO] New connection from 205.210.31.216


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 08:14:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<6eAUyRFEoH2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:14:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<OeapyRFEOj8tTeM5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 08:17:47 host2 sshd[2093592]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:18:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<L2lq1xFEYM9noNQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-21 08:18:05 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:60501: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-21 08:18:21 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:40234: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:18:21 host2 sshd[2094248]: Disconnected from invalid user michelle 83.168.78.153 port 35416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 08:18:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<RHgv2RFE0rVK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 08:20:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<CH0c3xFEguqKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 08:19:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<3xDm2xFEGrdn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:19:47 host2 sshd[2095754]: Disconnected from invalid user web 82.24.64.116 port 33496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 08:20:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<bfH73hFExoql0iHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:22:59 host2 sshd[2098076]: Disconnected from invalid user rahim 139.59.231.45 port 52054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:23:05 host2 sshd[2098169]: Disconnected from invalid user julio 82.24.64.116 port 43826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:24:04 host2 sshd[2098710]: Disconnected from invalid user user123 83.168.78.153 port 51054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.238
country_id: 2328926
description:
2025-11-21 08:24:26 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:1473: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:24:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<flyD7xFE9DItTeM5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-21 08:24:54 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:53180: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:25:47 host2 sshd[2099923]: Disconnected from invalid user mqm 139.59.231.45 port 59162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:26:14 host2 sshd[2100123]: Disconnected from invalid user administrator 83.168.78.153 port 59044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:26:14 host2 sshd[2100126]: Disconnected from invalid user boss 82.24.64.116 port 36686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov 21 08:27:09 host2 sshd[2100657]: Disconnected from invalid user comercial 139.59.231.45 port 37488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 21 08:28:17 host2 sshd[2101474]: Disconnected from invalid user comercial 83.168.78.153 port 43378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.116
country_id: 2635167
description:
Nov 21 08:29:12 host2 sshd[2102160]: Disconnected from invalid user administrator 82.24.64.116 port 55450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 08:30:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<E1jOBRJE+JOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.242.78.9
country_id: 3469034
description:
Nov 21 08:31:27 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=191.242.78.9, lip=66.85.158.91, TLS, session=<vFVvBhJEmIa/8k4J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.117
country_id: 3865483
description:
Nov 21 08:31:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.117.16.117, lip=66.85.158.91, TLS, session=<EszKBxJEfOeKdRB1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.74
country_id: 3469034
description:
Nov 21 08:33:02 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=177.39.32.74, lip=66.85.158.91, TLS, session=<YBQwDBJEYqaxJyBK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.113.110
country_id: 226074
description:
Nov 21 08:33:24 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=196.0.113.110, lip=66.85.158.91, TLS, session=<q6RkDRJERePEAHFu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 08:33:39 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<jjRNDxJEOoaSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 08:35:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<nja2FBJEQLGLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 08:41:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KJRhKxJEns+YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 08:42:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<x89tMBJElqqSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 08:43:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SoRKNBJECIcXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 08:44:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VSJYNRJE2rUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 08:45:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<BT48OBJEyMErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:45:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<A2JsOxJEkpQv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:46:08 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<TxsVPBJEFL4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:46:15 host2 dovecot[3366982]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<za6APBJEPL4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 08:46:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<G9ZQPBJE6J8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 08:46:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<yyyKPBJEpKovWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 08:46:49 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<0ptwPhJE5JkrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:47:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XJvQQBJEyIcDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 08:47:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<rvaOQRJEEosv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 08:47:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<ZayvQRJEaM4tPZWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:48:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MDN4QxJEioADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 08:48:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<jv75QxJE7pozTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 08:50:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<OX21SxJExOuElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 08:52:34 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<y4zzUhJEUJ4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 08:53:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<7yP+VhJEyudm1bVi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 21 08:54:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<ERIxWRJEyJgDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 08:56:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<uP8SYRJEjG0tTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 08:56:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<ama/YhJEAOZnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Nov 21 08:59:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.91, TLS handshaking: Connection closed, session=<u0FUbRJEZYpbxJi/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.188
country_id: 3017382
description:
Nov 21 09:00:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.188, lip=66.85.158.91, TLS: Connection closed, session=<K770bRJE57pbxJi8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.223
country_id: 3017382
description:
Nov 21 09:00:18 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.223, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Vuu7bhJER8BbxJjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.128
country_id: 798544
description:
Nov 21 09:00:21 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=178.219.102.128, lip=66.85.158.91, TLS, session=<fAj4bRJEbbOy22aA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 09:00:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<customers@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<44ZNbxJE4FKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.198
country_id: 2510769
description:
Nov 21 09:00:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=139.28.190.198, lip=66.85.158.91, TLS, session=<XA2jbxJEp9GLHL7G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 09:04:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9pjdexJEir+KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:06:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vIJDhBJETLFnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:07:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<66dRhxJEFLAtTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 09:07:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<zgdAiRJEwulK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 09:09:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qCApjhJENNhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-21 09:11:27 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:39308: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-21 09:11:43 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:47188: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 09:16:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<LJS6qBJEXp+kXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 21 09:20:45 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<3rjntxJEwq7CpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 09:22:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<rer0vhJE5p2LO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.145.247
country_id: 6252001
description:
Nov 21 09:24:54 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.145.247, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3YfAxhJEnugUQZH3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.111.36
country_id: 2921044
description:
Nov 21 09:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.111.36, lip=66.85.158.91, session=<gZN3yRJE+yFA4m8k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.179.242
country_id: 2921044
description:
Nov 21 09:25:40 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.179.242, lip=66.85.158.91, session=<xA19yRJEWjSnrLPy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.224.63
country_id: 6252001
description:
Nov 21 09:25:49 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.127.224.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9YoByhJEOsMUf+A/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 09:26:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<QxwMzhJEbOGYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.28.112
country_id: 3469034
description:
Nov 21 09:27:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=177.152.28.112, lip=66.85.158.91, TLS, session=<cZKi0BJEjemxmBxw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.124
country_id: 798544
description:
Nov 21 09:28:15 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.108.124, lip=66.85.158.91, TLS, session=<vhXC0RJEEapVymx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.104.64
country_id: 2921044
description:
Nov 21 09:28:17 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.68.104.64, lip=66.85.158.91, TLS, session=<lkTO0hJE2pmKRGhA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 09:29:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<mQ3S1hJENKcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.109.66
country_id: 3469034
description:
Nov 21 09:29:47 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=187.85.109.66, lip=66.85.158.91, TLS, session=<iBEE1xJEe+e7VW1C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.110
country_id: 3469034
description:
Nov 21 09:30:06 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art>, method=PLAIN, rip=191.37.11.110, lip=66.85.158.91, TLS, session=<hmlJ2BJEha6/JQtu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 21 09:30:47 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<4vug2xJEuOoI04Sw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 09:33:35 host2 sshd[2146199]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 21 09:33:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=45.61.149.165, lip=66.85.158.91, session=<M/IS5hJEUtQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 21 09:34:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vbZq5xJEpOMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.250.153
country_id: 6252001
description:
Nov 21 09:33:32 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.250.153, lip=66.85.158.91, session=<YoeA5RJEltMvWfqZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 09:34:05 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<6sdy5xJEmM6ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 21 09:35:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<y5FX6xJECJszTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 21 09:35:20 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<ifTo6xJEdqcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.102
country_id: 2921044
description:
2025-11-21 09:35:24 dovecot_login authenticator failed for (60hvPEBnK) [213.209.157.102]:59317: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 09:35:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<lW8x7BJEhM4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 09:35:52 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<wkzT7RJEYtwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.102
country_id: 2921044
description:
2025-11-21 09:36:10 dovecot_login authenticator failed for (brZvNrg9) [213.209.157.102]:51579: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 09:37:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@colperlab.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<4fRw8hJEDqArmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:39:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<jV/k+RJEQkItTeM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 21 09:41:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<k7j+ARNEGNhm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:43:42 host2 sshd[2152359]: Disconnected from invalid user test 118.194.231.208 port 33292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 21 09:44:57 host2 sshd[2153148]: Disconnected from invalid user destin 62.60.131.157 port 14513 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:45:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<OGOyEBNENOJnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 21 09:46:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<qfFbFRNEajuYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:47:22 host2 sshd[2155021]: Disconnected from invalid user user04 118.194.231.208 port 33516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 21 09:47:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gzkfGRNEQKGKxX03>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.105.81
country_id: 6252001
description:
Nov 21 09:49:06 host2 pure-ftpd[2156057]: (?@20.169.105.81) [INFO] New connection from 20.169.105.81


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:48:44 host2 sshd[2155703]: Disconnected from invalid user test 118.194.231.208 port 33616 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.227.57
country_id: 2635167
description:
Nov 21 09:50:00 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=45.77.227.57, lip=66.85.158.91, session=<TZlmIBNEAsItTeM5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Nov 21 09:49:23 host2 sshd[2156176]: Disconnected from invalid user wedding 118.194.231.208 port 33666 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 09:53:37 host2 sshd[2159117]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:54:41 host2 sshd[2160508]: Disconnected from invalid user neolinux 154.31.231.194 port 51326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 09:55:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<HZJOMhNEIONnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.107
country_id: 1819730
description:
Nov 21 09:55:41 host2 sshd[2161660]: Disconnected from invalid user sales 103.103.245.107 port 44960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:55:46 host2 sshd[2161705]: Disconnected from invalid user user2 107.150.20.228 port 40272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.103
country_id: 6252001
description:
Nov 21 09:55:59 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FKHlNRNEi9zG6xhn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:56:09 host2 sshd[2162000]: Disconnected from invalid user oracle 156.232.88.219 port 58552 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.176.42.158
country_id: 798544
description:
Nov 21 09:56:51 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@casa18villa.com>, method=PLAIN, rip=193.176.42.158, lip=66.85.158.91, TLS, session=<LmD/NxNEROXBsCqe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:56:59 host2 sshd[2162586]: Disconnected from invalid user roo 107.150.20.228 port 40396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.50
country_id: 953987
description:
Nov 21 09:57:13 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.43.50, lip=66.85.158.91, TLS, session=<ZIQhORNE0+NmQCsy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:57:19 host2 sshd[2162867]: Disconnected from invalid user ftpadmin1 156.232.88.219 port 58638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov 21 09:57:26 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<SxT6OhNEYJhK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:58:23 host2 sshd[2163591]: Disconnected from invalid user user2 154.31.231.194 port 59062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 21 09:58:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colourmarklabels.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1WnXPxNEKqhn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 09:58:06 host2 sshd[2163412]: Disconnected from invalid user ftpuser 107.150.20.228 port 40514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 09:59:45 host2 sshd[2164608]: Disconnected from invalid user ubuntu 154.31.231.194 port 52346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 09:59:46 host2 sshd[2164622]: Disconnected from invalid user marvin 156.232.88.219 port 58822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.232.88.219
country_id: 192950
description:
Nov 21 10:01:03 host2 sshd[2165695]: Disconnected from invalid user admin1 156.232.88.219 port 58912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.20.228
country_id: 2963597
description:
Nov 21 10:00:15 host2 sshd[2165241]: Disconnected from invalid user rdp 107.150.20.228 port 40750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.31.231.194
country_id: 1819730
description:
Nov 21 10:01:09 host2 sshd[2165758]: Disconnected from invalid user roo 154.31.231.194 port 41734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 10:02:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@melanifinefood.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<TST2TBNEGr+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 21 10:06:19 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=165.210.33.193, lip=66.85.158.91, session=<EDbAWhNEisul0iHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.107
country_id: 1819730
description:
Nov 21 10:08:04 host2 sshd[2170839]: Disconnected from invalid user actions 103.103.245.107 port 50668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-21 10:07:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55785: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 21 10:10:39 host2 sshd[2172630]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov 21 10:10:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ceylondigest.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<SOW2aBNExsaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Nov 21 10:12:06 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xgRqbxNEpo0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov 21 10:12:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<58RncRNEWLmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 10:13:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<c/s2dRNELrGSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.222
country_id: 3175395
description:
Nov 21 10:15:50 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@casa18villa.com>, method=PLAIN, rip=185.15.169.222, lip=66.85.158.91, TLS, session=<LczoexNEp5q5D6ne>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.217
country_id: 953987
description:
Nov 21 10:16:12 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.37.217, lip=66.85.158.91, TLS, session=<DUULfRNEStJmQCXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-11-21 10:18:31 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:59154: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-21 10:19:00 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:41776: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 21 10:19:11 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS, session=<H0fbiBNEHJfCpGsG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 21 10:21:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.91, session=<Z1lQkRNEsE3Y2s5C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-21 10:25:56 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:46100: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 21 10:25:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<mailbox@lakwelholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9qpTnxNEOKcXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.156.29.246
country_id: 1880251
description:
Nov 21 10:27:30 host2 sshd[2184304]: Disconnected from invalid user rizal 43.156.29.246 port 34122 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.10
country_id: 2264397
description:
Nov 21 10:28:36 host2 dovecot[3366982]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.10, lip=66.85.158.91, TLS, session=<8TWJqhNEtay5tI0K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.8
country_id: 2264397
description:
Nov 21 10:28:38 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.8, lip=66.85.158.91, TLS, session=<H4mtqhNEDeS5tI0I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.7
country_id: 2264397
description:
Nov 21 10:28:37 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.7, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VSmXqhNEjMi5tI0H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.9
country_id: 2264397
description:
Nov 21 10:28:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.180.141.9, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<YLTOqhNEXai5tI0J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.10
country_id: 2264397
description:
Nov 21 10:28:43 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 1 secs): user=<>, rip=185.180.141.10, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<Bi3tqhNEJ865tI0K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 10:28:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<nm21qhNEdrGUcQQF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 21 10:30:18 host2 sshd[2186047]: Disconnected from invalid user postgres 197.5.145.102 port 54474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 10:30:27 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<pz8DsRNEQtiElIx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:31:27 host2 sshd[2186759]: Disconnected from invalid user orange 166.170.45.118 port 29966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:32:40 host2 sshd[2187614]: Disconnected from invalid user tutor 166.170.45.118 port 58601 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:34:57 host2 sshd[2188937]: Disconnected from invalid user eric 166.170.45.118 port 29933 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 10:34:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<lgbFvhNEoNVo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 10:35:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<KWw+wxNE1ONn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 21 10:37:19 host2 sshd[2190625]: Disconnected from invalid user keycloak 166.170.45.118 port 51554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 10:37:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xsGzyRNEcNZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 10:38:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<BCMbzBNEhoh2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 10:39:48 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<A65+0hNEOKFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 10:42:25 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<ILXI2xNESN85gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 10:42:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<+uZV3BNExJYI3ocK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.156.29.246
country_id: 1880251
description:
Nov 21 10:43:22 host2 sshd[2194752]: Disconnected from invalid user tutor 43.156.29.246 port 59808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Nov 21 10:44:08 host2 sshd[2195319]: Disconnected from invalid user scp 197.5.145.102 port 54486 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 10:44:11 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WQMr4hNErSNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 10:46:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<SjQs6RNEKMlnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 10:47:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<Er4q7hNEdOhz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 10:49:07 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<QQrH8xNEeKAv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov 21 10:51:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@euroentertainmentlk.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<LaQ2/RNEdD4v9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 10:52:14 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<QCnx/hNECLRAF4KF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 10:52:31 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<SEbu/xNEWoVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 10:53:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<psP1BBRE/LKWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.76
country_id: 798544
description:
Nov 21 10:53:20 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<art@bostonlanka.com>, method=PLAIN, rip=109.125.249.76, lip=66.85.158.91, TLS, session=<ldr+ARREBtttfflM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.56
country_id: 1269750
description:
Nov 21 10:53:41 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<art>, method=PLAIN, rip=103.207.4.56, lip=66.85.158.91, TLS, session=<P10dAxREyrhnzwQ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 10:56:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aOiVDhREFMojy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 10:56:54 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<Ib2ZDxREwoQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 10:56:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<sRPHDxREHJgvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 10:57:13 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<8d7iEBREfvIjy9Lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.208
country_id: 6252001
description:
Nov 21 10:59:48 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.208, lip=66.85.158.92, session=<pb4gGhREuvzN0h/Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.230
country_id: 2635167
description:
Nov 21 11:01:36 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.230, lip=66.85.158.92, TLS, session=<n0mJIBRE5OAjy9Lm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 11:02:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@colourmarklabels.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<ogitIxREqjkv7YNh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 21 11:02:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Q8+NJBREBuOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 21 11:03:12 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<biImJhREtMykXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-11-21 11:04:57 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:44784: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-21 11:05:14 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:44857: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.65.137.126
country_id: 3996063
description:
Nov 21 11:06:58 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=38.65.137.126, lip=66.85.158.91, TLS, session=<JfnGMhREfJ8mQYl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 11:06:58 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@gemtrails.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<UxaiMxRE9KII3ocK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.179
country_id: 3175395
description:
Nov 21 11:07:16 host2 dovecot[3366982]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.179, lip=66.85.158.91, TLS, session=<T53ZMxRE4ZK5xQmz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov 21 11:07:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<WrjFNhREktJn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 21 11:08:01 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=152.53.188.144, lip=66.85.158.91, session=<sy5lNxREcpaYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:08:03 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@gemtrails.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<Ef2ENxRE4qCElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 11:08:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<UKzLORRECp9nOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 21 11:09:38 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@lakwelholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<giYjPRREePqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 21 11:13:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=132.148.140.121, lip=66.85.158.91, session=<PhidShREtuqElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 11:14:42 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<16tNTxREiJNz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 21 11:16:09 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@maximsholdings.com>, method=PLAIN, rip=148.113.4.5, lip=66.85.158.91, session=<siZ4VBRElsGUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov 21 11:17:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<pWDpWRREsoJo7CMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.244
country_id: 2635167
description:
Nov 21 11:18:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.244, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XfqcXhRE69ZX7LD0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.147
country_id: 2635167
description:
Nov 21 11:18:57 host2 dovecot[3366982]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.147, lip=66.85.158.91, TLS, session=<gzSUXhREk5BX7LCT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.230
country_id: 2635167
description:
Nov 21 11:20:04 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.230, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<VdiTYhREqYxX7LDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 21 11:19:30 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z0qYYBREschX7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.219
country_id: 2635167
description:
Nov 21 11:20:37 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.219, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<2BOPZBRE0YNX7LDb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.247
country_id: 2635167
description:
Nov 21 11:21:10 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.247, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<VluKZhREIbO594n3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov 21 11:21:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<TlkcZxRERr1n9Sd0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.161
country_id: 6252001
description:
Nov 21 11:21:31 host2 sshd[2222035]: Disconnected from invalid user admin 203.161.56.161 port 58744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.219
country_id: 2635167
description:
Nov 21 11:21:43 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vPyDaBREfcm594nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.252
country_id: 2635167
description:
Nov 21 11:22:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.252, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DEeBahREx9RX7LD8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Nov 21 11:22:51 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<CxyMbBREF5FX7LDe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Nov 21 11:23:24 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<DZCFbhRE499X7LD5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 21 11:23:29 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<dx+5bhREELFA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.242
country_id: 2635167
description:
Nov 21 11:23:57 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Ye6AcBREW5y594ny>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.161
country_id: 6252001
description:
Nov 21 11:25:09 host2 sshd[2224795]: Disconnected from invalid user newusername 203.161.56.161 port 33042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:26:08 host2 sshd[2225636]: Disconnected from invalid user zjh 154.72.233.36 port 55068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 21 11:26:35 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<CVLLeRREzo92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.135.10
country_id: 1880251
description:
Nov 21 11:27:33 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@nsteeleng.com>, method=PLAIN, rip=8.222.135.10, lip=66.85.158.91, session=<sy1EfRRE5MQI3ocK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:28:20 host2 sshd[2227105]: Disconnected from invalid user tania 154.72.233.36 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Nov 21 11:29:27 host2 sshd[2227811]: Disconnected from invalid user vncuser 154.72.233.36 port 45580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:29:40 host2 sshd[2227973]: Disconnected from invalid user minecraft 45.164.39.253 port 40724 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:31:11 host2 sshd[2229295]: Disconnected from invalid user deamon 45.164.39.253 port 43944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Nov 21 11:31:41 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<XuoHjBREGKRnmSo4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 21 11:31:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EuNPjBREYDdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.164.39.253
country_id: 3469034
description:
Nov 21 11:32:39 host2 sshd[2230276]: Disconnected from invalid user ubuntu 45.164.39.253 port 47166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.131.97
country_id: 1880251
description:
Nov 21 11:33:16 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.237.131.97, lip=66.85.158.91, session=<HxypkRREECUv7YNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-11-21 11:34:31 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:50638: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-21 11:35:08 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:57670: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 21 11:37:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<J2yyoRREAsCSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 21 11:37:44 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=103.56.148.108, lip=66.85.158.91, session=<K/SioRRENJBnOJRs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:37:48 host2 sshd[2233926]: Disconnected from invalid user dev 103.67.78.132 port 43914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov 21 11:37:55 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@colperlab.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<7FBIohREZoo5gL/H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-21 11:37:21 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:57604: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-21 11:37:29 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:55510: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov 21 11:38:22 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<lH/yoxRE4qhnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:38:42 host2 sshd[2234465]: Disconnected from invalid user sahil 50.6.226.167 port 35292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov 21 11:39:21 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<+2xwpxREz5IvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:40:15 host2 sshd[2235714]: Disconnected from invalid user wow 103.67.78.132 port 34622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 21 11:40:17 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<wQTBqhREhI2WXx+e>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.132
country_id: 1643084
description:
Nov 21 11:41:52 host2 sshd[2237286]: Disconnected from invalid user soporte 103.67.78.132 port 55880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:41:11 host2 sshd[2236695]: Disconnected from invalid user testuser 50.6.226.167 port 58692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Nov 21 11:41:45 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<gyoDsBREGuRz8UML>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.226.167
country_id: 6252001
description:
Nov 21 11:42:19 host2 sshd[2237731]: Disconnected from invalid user admin 50.6.226.167 port 37978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.181.197
country_id: 732800
description:
Nov 21 11:42:51 host2 sshd[2238194]: Disconnected from invalid user wow 212.233.181.197 port 48354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 21 11:43:40 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<aSrbthREDLMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.130.133
country_id: 6252001
description:
Nov 21 11:43:46 host2 dovecot[3366982]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=64.23.130.133, lip=66.85.158.91, session=<IJdDtxREILJAF4KF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.252.118.164
country_id: 1819730
description:
Nov 21 11:43:59 host2 sshd[2239073]: Disconnected from invalid user alex 103.252.118.164 port 32068 [preauth]


