# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 16:38:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<rL/mM/9CbNIXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.247.226
country_id: 1643084
description:
Nov  7 16:38:54 host2 sshd[3232204]: Disconnected from invalid user admin 36.93.247.226 port 37208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov  7 16:38:58 host2 sshd[3232263]: Disconnected from invalid user tata 154.91.170.52 port 44334 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.29.49.209
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.29.49.209 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.163.102
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.136.163.102 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.28.146.223
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 96.28.146.223 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov  7 16:38:18 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, session=<l97vMv9CYCVAPsUC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov  7 16:39:18 host2 sshd[3232724]: Disconnected from invalid user kali 179.43.189.36 port 51388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 16:39:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<E5GRNv9CuqqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 16:39:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<LFYaN/9CqJxo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 16:41:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<fIxFPv9CtIEBFNmn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.247.226
country_id: 1643084
description:
Nov  7 16:41:58 host2 sshd[3235489]: Disconnected from invalid user hieu 36.93.247.226 port 39376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.146
country_id: 1880251
description:
Nov  7 16:41:16 host2 sshd[3234806]: Disconnected from invalid user admin 45.78.222.146 port 55692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Nov  7 16:42:22 host2 sshd[3235975]: Disconnected from invalid user user 209.15.115.240 port 47790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.14
country_id: 1880251
description:
Nov  7 16:42:25 host2 sshd[3235964]: Disconnected from invalid user newuser 45.78.222.14 port 57244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.27.134.38
country_id: 1168579
description:
Nov  7 16:43:12 host2 sshd[3236826]: Disconnected from invalid user admin2 58.27.134.38 port 42923 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.247.226
country_id: 1643084
description:
Nov  7 16:43:24 host2 sshd[3236938]: Disconnected from invalid user visitor 36.93.247.226 port 40464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 16:44:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<Cut+Sf9CfKwv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 16:46:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<MeywT/9CQrcv+yvF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  7 16:47:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<ZRtqVP9CZMRHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 16:48:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<wLIcVv9CSuYI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 16:48:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<tXqxWP9CTsktTSjg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov  7 16:50:15 host2 sshd[3244949]: Disconnected from invalid user dspace 154.91.170.52 port 40626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 16:50:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<o1cNXv9CBqpK0NqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Nov  7 16:50:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<cyqjX/9CFJxHBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Nov  7 16:51:42 host2 sshd[3246521]: Disconnected from invalid user deploy 89.47.53.19 port 33476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.240
country_id: 798549
description:
Nov  7 16:51:17 host2 sshd[3246026]: Disconnected from invalid user ca 89.44.137.240 port 60644 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.52.206.163
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.52.206.163 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.254.3
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.58.254.3 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.136.52
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.175.136.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.132.15.124
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.132.15.124 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Nov  7 16:53:05 host2 sshd[3247942]: Disconnected from invalid user abc 89.47.53.19 port 36244 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.200.227
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.36.200.227 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.148.99.44
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 73.148.99.44 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.31.34.118
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.31.34.118 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 16:55:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<oQ9/b/9COtw+PIOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Nov  7 16:55:45 host2 sshd[3251746]: Disconnected from invalid user demo 89.47.53.19 port 41770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 1819730
description:
Nov  7 16:55:50 host2 sshd[3251850]: Disconnected from invalid user grass 154.219.125.194 port 39272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 16:56:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<ms9Scv9C/NBn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 16:56:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Y91gdf9CIpCLO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 1819730
description:
Nov  7 16:57:03 host2 sshd[3253105]: Disconnected from invalid user sendmail 154.219.125.194 port 41710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.240
country_id: 798549
description:
Nov  7 16:56:26 host2 sshd[3252507]: Disconnected from invalid user backend 89.44.137.240 port 59136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.240
country_id: 798549
description:
Nov  7 16:57:37 host2 sshd[3253747]: Disconnected from invalid user user7 89.44.137.240 port 37888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.146
country_id: 1880251
description:
Nov  7 16:57:48 host2 sshd[3253854]: Disconnected from invalid user zgr 45.78.222.146 port 34046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 16:59:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<WDtUff9CbIVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.14
country_id: 1880251
description:
Nov  7 17:00:39 host2 sshd[3257082]: Disconnected from invalid user odoo13 45.78.222.14 port 38298 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.193
country_id: 99237
description:
2025-11-07 17:02:18 dovecot_plain authenticator failed for (reopectop) [65.20.204.193]:46686: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.222.14
country_id: 1880251
description:
Nov  7 17:03:19 host2 sshd[3260313]: Disconnected from invalid user admin 45.78.222.14 port 50622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 17:04:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<DeajkP9CHOAv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  7 17:04:57 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<bbk7kv9C3odChJmC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov  7 17:05:20 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<Quiak/9CrKpChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-11-07 17:05:43 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (tacul) [90.0.156.128]:49398: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 17:07:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wNJomf9CQrjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 17:07:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<eywFmv9Cpi+d5p7H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 17:07:37 host2 sshd[3265273]: Disconnected from invalid user ayden 62.60.131.157 port 63615 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 17:07:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<+WLOnP9CrN0v+yvF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.222.14
country_id: 1880251
description:
Nov  7 17:08:27 host2 sshd[3266152]: Disconnected from invalid user kingbase 45.78.222.14 port 57368 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.49.112.12
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.49.112.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.208.230.79
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 32.208.230.79 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.10.132.80
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.10.132.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.149.26.74
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 35.149.26.74 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.220.92
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.56.220.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.115.84.143
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 66.115.84.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.208.202.244
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.208.202.244 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 17:09:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<fM4Qov9C3Ikv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 17:13:06 host2 sshd[3271089]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 17:13:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<OUF3sf9CcMZCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 17:15:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<xuSot/9COuIvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.226.113
country_id: 290557
description:
2025-11-07 17:16:38 dovecot_plain authenticator failed for (thoudo) [87.200.226.113]:40148: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 17:17:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<e3qnvf9C1EYrh5l8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-07 17:17:59 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:49482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 17:18:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<LO4LxP9CxKbRJpe/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 17:20:04 host2 sshd[3278648]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 17:21:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<bBcgzP9CFIs5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.245.108.234
country_id: 1269750
description:
Nov  7 17:23:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=157.245.108.234, lip=66.85.158.91, session=<OItO1f9CIs2d9Wzq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.34
country_id: 6252001
description:
Nov  7 17:24:55 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.15.34, lip=66.85.158.91, session=<79Ke2f9CAOUUow8i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-07 17:27:41 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:33588: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-07 17:27:55 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:38796: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 17:29:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<FKGk6f9CuNMI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 17:29:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<fUG16f9Cyowv+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 17:30:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gjTp7P9CRuwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 17:30:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1X4u7v9CiL6YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 17:30:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<fmXc7v9C0JM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 17:31:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<COsX8v9CdJQBFNmn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 17:32:49 host2 sshd[3291794]: Disconnected from invalid user garrison 62.60.131.157 port 24803 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.145
country_id: 3017382
description:
Nov  7 17:33:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.145, lip=66.85.158.91, session=<FFNC+f9CX8Bb51mR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 17:33:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<txqq9/9ChJFo7CMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.233
country_id: 3017382
description:
Nov  7 17:33:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.233, lip=66.85.158.91, session=<HjSl+P9Cu9pb51np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 17:39:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<pM7/DQBDmosv9XzN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.244.67
country_id: 6252001
description:
Nov  7 17:40:38 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=1002) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=20.127.244.67, lip=66.85.158.92, session=<3WXZEQBDYL4Uf/RD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 17:41:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=</ztiFABDfo2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 17:41:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<8xihFABDYKQtTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 17:42:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<JsyxFwBDcN0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 17:43:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Al3XGgBDWKMI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  7 17:42:21 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<d+v4FwBDCpUDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 17:44:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<cObfHgBDBqFK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 17:45:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<0UfnIwBDHrQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 17:46:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<atjAJQBDrMzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 17:46:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<WSDXJgBDuJdn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov  7 17:50:39 host2 sshd[3315539]: Disconnected from invalid user camera 154.221.28.214 port 53930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 17:51:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<XdT3NgBDJo4v+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 17:51:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<6peSNwBDJqeLO0qU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.146.57.41
country_id: 1880251
description:
[2025-11-07 17:51:48 +0530] info [cpaneld] 156.146.57.41 - ksoftweb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.146.57.41
country_id: 1880251
description:
[2025-11-07 17:52:22 +0530] info [cpaneld] 156.146.57.41 - ksoftweb "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 17:55:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1/k1RgBDBpNnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.57.19
country_id: 6252001
description:
[2025-11-07 17:56:28 +0530] info [cpaneld] 98.115.57.19 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.116.34.98
country_id: 6252001
description:
[2025-11-07 17:56:36 +0530] info [cpaneld] 98.116.34.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.127.6.66
country_id: 6252001
description:
[2025-11-07 17:56:38 +0530] info [cpaneld] 172.127.6.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.27.23.60
country_id: 6252001
description:
[2025-11-07 17:56:43 +0530] info [whostmgrd] 96.27.23.60 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.216.146.14
country_id: 6252001
description:
[2025-11-07 17:56:51 +0530] info [cpaneld] 76.216.146.14 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.4.195.228
country_id: 6252001
description:
[2025-11-07 17:56:55 +0530] info [cpaneld] 107.4.195.228 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.96.14.47
country_id: 6252001
description:
[2025-11-07 17:56:49 +0530] info [cpaneld] 24.96.14.47 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 17:57:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<pzmXTwBDUsad5p7H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 17:58:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<0HVwUABDyM4v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.7.230.134
country_id: 3895114
description:
Nov  7 17:59:27 host2 sshd[3327882]: Disconnected from invalid user tv 45.7.230.134 port 41550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 18:00:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<5leaWQBDbs3IMGRT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.30.235.30
country_id: 6252001
description:
[2025-11-07 18:01:02 +0530] info [cpaneld] 76.30.235.30 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.102.152
country_id: 6252001
description:
[2025-11-07 18:01:06 +0530] info [cpaneld] 172.56.102.152 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.83.79.77
country_id: 6252001
description:
[2025-11-07 18:01:12 +0530] info [cpaneld] 97.83.79.77 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.74.148.84
country_id: 6252001
description:
[2025-11-07 18:01:14 +0530] info [whostmgrd] 24.74.148.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov  7 18:01:26 host2 sshd[3331848]: Disconnected from invalid user king 154.221.28.214 port 43034 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.165.69.177
country_id: 6252001
description:
[2025-11-07 18:01:17 +0530] info [cpaneld] 97.165.69.177 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.191.86
country_id: 6252001
description:
[2025-11-07 18:01:21 +0530] info [cpaneld] 99.56.191.86 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.251.196.149
country_id: 6252001
description:
[2025-11-07 18:01:19 +0530] info [cpaneld] 216.251.196.149 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 18:06:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<NcnCbgBDjHMvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov  7 18:06:50 host2 sshd[3341440]: Disconnected from invalid user admin 154.221.28.214 port 52780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Nov  7 18:08:38 host2 sshd[3344222]: Disconnected from invalid user azure 154.221.28.214 port 43522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 18:09:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<tDUxeABD0oBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 18:10:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<JwrQewBDws7RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 18:12:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<gNYWgwBDLqM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 18:12:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<ouJ9hABDxqIv+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 18:13:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<DqCJhwBD+AQrh5l8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov  7 18:14:56 host2 sshd[3352249]: Disconnected from invalid user nexus 103.231.14.54 port 49224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.17
country_id: 953987
description:
Nov  7 18:15:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=102.64.33.17, lip=66.85.158.91, TLS, session=<HTA5jgBDLbRmQCER>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.168
country_id: 3175395
description:
Nov  7 18:16:02 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.168, lip=66.85.158.91, TLS, session=<7MtxjwBDCt+5xQmo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov  7 18:16:40 host2 sshd[3354193]: Disconnected from invalid user testuser 103.231.14.54 port 35960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.245.108.234
country_id: 1269750
description:
Nov  7 18:18:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=157.245.108.234, lip=66.85.158.91, session=<Rr/zmQBD2L+d9Wzq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 18:19:20 host2 sshd[3357261]: Disconnected from invalid user garrison 62.60.131.157 port 11915 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-07 18:19:55 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:41220: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 18:21:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<iC94pQBDJqcBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 18:22:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<OdLKpQBD3NKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 18:22:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<dA/KpgBDLHUI2zHw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.188.37
country_id: 6252001
description:
[2025-11-07 18:22:59 +0530] info [cpaneld] 35.139.188.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.210.106.201
country_id: 6252001
description:
[2025-11-07 18:23:08 +0530] info [cpaneld] 151.210.106.201 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 18:23:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<TWeOqwBDauwzTY0d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.205.205.24
country_id: 6252001
description:
[2025-11-07 18:23:16 +0530] info [cpaneld] 68.205.205.24 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Nov  7 18:23:23 host2 sshd[3362569]: Disconnected from invalid user acct 103.231.14.54 port 56620 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.1.172.183
country_id: 6252001
description:
[2025-11-07 18:22:57 +0530] info [cpaneld] 172.1.172.183 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.0.78
country_id: 6252001
description:
[2025-11-07 18:23:00 +0530] info [cpaneld] 98.97.0.78 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.177.130.207
country_id: 6252001
description:
[2025-11-07 18:23:02 +0530] info [whostmgrd] 70.177.130.207 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.67.17.146
country_id: 6252001
description:
[2025-11-07 18:23:13 +0530] info [cpaneld] 74.67.17.146 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 18:27:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<UR57twBDxsI5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 18:27:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<DD7uuQBD3J1o7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 18:32:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<EPiAywBD6ogv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-11-07 18:32:00 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:58451: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-11-07 18:32:29 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:55138: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  7 18:32:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<y59lywBDFsY+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 18:33:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<DWJmzwBDmmEv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 18:35:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<sJuj1gBDDOkv+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 18:35:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<r3VN1QBDqKotTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 18:37:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=</x5Q3ABD+MsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 18:37:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<SLX73ABDVrNK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 18:38:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<+/PV3gBDYN5n9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-07 18:40:51 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:38008: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-07 18:40:59 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:33028: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  7 18:42:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<IQO+7QBDtOI+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 18:43:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<B4z68ABDhoKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 18:44:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<6+Iv9wBDoL4v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 18:45:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Au7u+gBDasGLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 18:48:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<HAgABQFDirgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 18:48:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<co8FBgFDyKCd5p7H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 18:51:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lLbZDwFDKu5nmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 18:52:10 host2 sshd[3394771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.230.73.253
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.230.73.253 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.255.17.126
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 69.255.17.126 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.200.119
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.187.200.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.9.122.246
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.9.122.246 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 18:53:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<st2SFAFD1LYXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.44.65.80
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.44.65.80 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.168.62
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 98.46.168.62 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.77.54
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.33.77.54 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-07 18:54:27 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:59864: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 18:54:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<HclgGgFDur3IMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-07 18:54:15 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:43912: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.71
country_id: 6252001
description:
Nov  7 18:56:09 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.71, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ts3gHwFDlo5iUARH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 18:57:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<sDR7IwFD6OUv+yvF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 18:58:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 18 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<vkoGKAFDytDBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 18:59:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<9IVvLAFDQAcvWbHj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 18:59:10 host2 sshd[3402355]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 19:02:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<KjWQNgFDxNDRJpe/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.57
country_id: 6252001
description:
Nov  7 19:02:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.57, lip=66.85.158.91, session=<tfd2NwFDqNESYQU5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  7 19:04:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<kBvuPAFDrNQ+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-07 19:05:01 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:14644: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-07 19:05:35 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:37674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 19:05:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<aXZ9QgFDOJpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 19:09:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<bNY9UAFDiLkrh5l8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.103
country_id: 1880251
description:
Nov  7 19:10:38 host2 sshd[3415767]: Disconnected from invalid user rustserver 101.47.163.103 port 58778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 19:12:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<GAMBWgFDeroBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 19:13:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<yIyvXQFDUJeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.245.108.234
country_id: 1269750
description:
Nov  7 19:12:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=157.245.108.234, lip=66.85.158.91, session=<fDi4WwFDfqSd9Wzq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov  7 19:14:41 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<9aotYgFDdoED7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 19:15:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<h1oJZgFDdDkI2zHw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.91
country_id: 6252001
description:
Nov  7 19:16:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.155.91, lip=66.85.158.91, TLS: Connection closed, session=<leLeaAFDNtjHLZtb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov  7 19:15:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tvvbZgFDKJ5ChJmB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 19:16:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<iJCWaAFDeuwzTY0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 19:17:03 host2 sshd[3422755]: Disconnected from invalid user user 2.57.121.25 port 50807 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.43.197
country_id: 6252001
description:
Nov  7 19:18:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=47.251.43.197, lip=66.85.158.91, session=<A5twbgFDMtAv+yvF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.163.103
country_id: 1880251
description:
Nov  7 19:18:21 host2 sshd[3424094]: Disconnected from invalid user admin 101.47.163.103 port 55330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.177.166.47
country_id: 357994
description:
Nov  7 19:20:01 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=154.177.166.47, lip=66.85.158.91, session=<rHQEdQFDxqKasaYv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.174.34.49
country_id: 1269750
description:
Nov  7 19:20:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<marketing>, method=PLAIN, rip=103.174.34.49, lip=66.85.158.91, session=<JVPGdgFDGdlnriIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.166.253.226
country_id: 1269750
description:
Nov  7 19:21:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 17 secs): user=<marketing>, method=LOGIN, rip=122.166.253.226, lip=66.85.158.91, session=<hLq9dwFDAZx6pv3i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.223.176.171
country_id: 6252001
description:
Nov  7 19:21:18 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 15 secs): user=<marketing>, method=PLAIN, rip=50.223.176.171, lip=66.85.158.91, TLS, session=<RHD5eAFDyZoy37Cr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 19:22:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<C0JBfQFDnqxo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 19:21:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<yv74ewFDqt4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 19:28:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<nvblkQFDXIEtTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 19:28:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<wA9zkgFD7lsv9XzN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 19:28:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<qZchlAFD1Nxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 19:29:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<aTCSlwFDOqxK0NqG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 19:30:47 host2 sshd[3437408]: Disconnected from invalid user stuart 62.60.131.157 port 30180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 19:30:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<+bXMmwFD7IQI04Sw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.168.112
country_id: 6252001
description:
Nov  7 19:31:53 host2 sshd[3438506]: Disconnected from invalid user vladimir 172.245.168.112 port 45482 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Nov  7 19:31:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PUsLoAFDqNe4aYtG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 19:33:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<LnvapQFDhqk5gL/H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov  7 19:35:19 host2 sshd[3442298]: Disconnected from invalid user user 172.245.168.112 port 57580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 19:35:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<R9NjrQFDCK4v+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.168.112
country_id: 6252001
description:
Nov  7 19:36:27 host2 sshd[3443404]: Disconnected from invalid user carla 172.245.168.112 port 49112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 19:37:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<3aBitQFDrLEv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.103
country_id: 1880251
description:
Nov  7 19:38:58 host2 sshd[3445918]: Disconnected from invalid user teste 101.47.163.103 port 44230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov  7 19:40:13 host2 sshd[3447568]: Disconnected from invalid user rmartinez 40.160.2.64 port 39522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 19:40:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<jbe4vgFDGOKd5p7H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 19:40:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oZSdvwFDZo6LO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov  7 19:41:28 host2 sshd[3448949]: Disconnected from invalid user newuser 40.160.2.64 port 55136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Nov  7 19:41:40 host2 sshd[3449063]: Disconnected from invalid user dot 20.74.129.186 port 5787 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.86
country_id: 6252001
description:
Nov  7 19:42:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.86, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<xIokxgFDtPCTuYRW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 19:43:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<FSVfxwFDJLal0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.86
country_id: 6252001
description:
Nov  7 19:44:32 host2 dovecot[3154217]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=147.185.132.86, lip=66.85.158.92, TLS handshaking, session=<zJjyzAFDW9eTuYRW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.160.2.64
country_id: 6252001
description:
Nov  7 19:44:59 host2 sshd[3453456]: Disconnected from invalid user cms 40.160.2.64 port 41856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-07 19:46:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (arsoring) [196.47.172.253]:51742: 535 Incorrect authentication data (set_id=support@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.160.2.64
country_id: 6252001
description:
Nov  7 19:47:17 host2 sshd[3456257]: Disconnected from invalid user drew 40.160.2.64 port 54526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 19:48:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yaN/2gFDrKtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 19:48:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<vNdQ2wFDso3IMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.86
country_id: 6252001
description:
Nov  7 19:47:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.86, lip=66.85.158.92, TLS, session=<pJXU2AFDpveTuYRW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.56
country_id: 1880251
description:
Nov  7 19:49:59 host2 sshd[3459271]: Disconnected from invalid user tom 101.47.50.56 port 43658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov  7 19:50:26 host2 sshd[3459955]: Disconnected from invalid user drew 182.93.50.90 port 54056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.233.57.93
country_id: 290557
description:
Nov  7 19:51:36 host2 sshd[3461300]: Disconnected from invalid user git 20.233.57.93 port 62241 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 19:51:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<KjhS5gFDSZIvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 19:52:27 host2 sshd[3462324]: Disconnected from invalid user user 2.57.121.25 port 52830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.56
country_id: 1880251
description:
Nov  7 19:52:52 host2 sshd[3462733]: Disconnected from invalid user ftpuser 101.47.50.56 port 34260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 19:52:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<Z0ft6gFDytbRJpe/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  7 19:55:58 host2 sshd[3466905]: Disconnected from invalid user amira 62.60.131.157 port 54066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Nov  7 19:55:50 host2 sshd[3466774]: Disconnected from invalid user mbp 20.74.129.186 port 43478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.186
country_id: 290557
description:
Nov  7 19:57:17 host2 sshd[3468393]: Disconnected from invalid user chrome 20.74.129.186 port 39853 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 19:57:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<s0rP+wFD3qsXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.50.56
country_id: 1880251
description:
Nov  7 19:58:03 host2 sshd[3469091]: Disconnected from invalid user opus 101.47.50.56 port 54194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  7 19:59:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<N+h6AwJD9qg+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 20:00:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<eI/gBAJDyM1CYSpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov  7 20:01:34 host2 sshd[3473028]: Disconnected from invalid user kafka 198.23.143.193 port 44586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov  7 20:03:20 host2 sshd[3475210]: Disconnected from invalid user vpnuser 182.93.50.90 port 42128 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 20:03:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<qEsmEQJDsNABFNmn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.227.103.150
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.227.103.150 - 0777332458 "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov  7 20:04:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<chRxFAJDLf4t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 20:04:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ceEiFQJDppqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 20:04:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=</++XEgJDGmgrh5l8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov  7 20:08:34 host2 sshd[3481078]: Disconnected from invalid user odoo15 198.23.143.193 port 56606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 20:09:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<7OVIJQJDTrjBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 20:09:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<otpAJgJDpqcI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 20:09:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<PAtrJgJDoOwzTY0d>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.50.90
country_id: 1821275
description:
Nov  7 20:09:54 host2 sshd[3482578]: Disconnected from invalid user nodejs 182.93.50.90 port 48984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.52
country_id: 1168579
description:
Nov  7 20:11:35 host2 sshd[3484766]: Disconnected from invalid user fmaster 58.27.134.52 port 59996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 20:11:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<zUFfLgJDTOUv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.233.57.93
country_id: 290557
description:
Nov  7 20:13:15 host2 sshd[3486987]: Disconnected from invalid user anne 20.233.57.93 port 18498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Nov  7 20:14:20 host2 sshd[3488332]: Disconnected from invalid user asd 198.23.143.193 port 58268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 20:15:11 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:56949: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 20:16:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<0giTQAJDWtRo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov  7 20:17:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<aVjqQgJDcoXE+1g2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Nov  7 20:17:57 host2 sshd[3492323]: Disconnected from invalid user user9 198.23.143.193 port 59274 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov  7 20:18:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<nFWnRwJDBI/E+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 20:19:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<lrtzSQJDKq5n9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov  7 20:20:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<vgAHTQJDJoDE+1g2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.74.129.184
country_id: 290557
description:
Nov  7 20:20:31 host2 sshd[3495047]: Disconnected from invalid user rizzo 20.74.129.184 port 12064 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 20:20:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<oeEaTwJDFqctTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov  7 20:21:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<ZEfNUAJDkNDE+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 20:21:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<HtpzUgJDuKFK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.88.54
country_id: 2750405
description:
Nov  7 20:23:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.88.54, lip=66.85.158.91, session=<AW4nWAJDRNjE+1g2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 20:23:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<BjgkVwJDTusv9XzN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.27.134.52
country_id: 1168579
description:
Nov  7 20:25:00 host2 sshd[3499635]: Disconnected from invalid user grass 58.27.134.52 port 41956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 20:24:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<rJKYWgJDhKsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 20:26:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<B+9EZAJDhJ0v+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-07 20:27:10 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:62704: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.204.148.29
country_id: 1210997
description:
2025-11-07 20:27:46 dovecot_login authenticator failed for ([116.204.148.28]) [116.204.148.29]:43762: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 20:28:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<43RzaQJDAq0v7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-07 20:30:23 dovecot_plain authenticator failed for (pretatics) [65.20.143.159]:47126: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 20:31:28 host2 sshd[3506527]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 20:32:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<zyfDdgJDbsGd5p7H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-07 20:35:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61475: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-11-07 20:37:08 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (ruccoce) [37.150.8.174]:52039: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 20:36:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<OFYMhwJDSN+LO0qU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 20:38:28 host2 sshd[3513953]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-11-07 20:41:18 dovecot_login authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:50323: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.42
country_id: 6252001
description:
Nov  7 20:41:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.42, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p6sLmAJDudhAPsUq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.102
country_id: 1269750
description:
2025-11-07 20:41:34 dovecot_login authenticator failed for ([128.185.241.177]) [182.95.54.102]:39670: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Nov  7 20:41:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ctM5mQJDKs5APsUg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 20:42:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<HssjmwJD6K7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 20:42:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<7SrlmwJDzOY5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 20:43:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<MsicngJD/sml0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 20:43:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<ThElnwJDsyMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 20:43:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<bBLqnwJDsrbRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 20:45:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<BUPhpgJDuNZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-07 20:47:06 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:59539: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-11-07 20:47:28 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:32884: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.218
country_id: 6252001
description:
Nov  7 20:51:00 host2 pure-ftpd[3527266]: (?@205.210.31.218) [INFO] New connection from 205.210.31.218


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 20:54:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<NSRsxgJD8q1CYSpH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.164
country_id: 2993457
description:
Nov  7 20:54:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<W5sdxwJD4v/CpRCk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 20:55:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<88XmyAJDPuYBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 20:55:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Q72JywJDsoGYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.245.108.234
country_id: 1269750
description:
Nov  7 20:55:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=157.245.108.234, lip=66.85.158.91, session=<EZLVywJDiIud9Wzq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  7 20:55:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<z4F5yQJDhqai8JQo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov  7 20:59:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, session=<OmMz2QJD3P4t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 20:59:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<PjSV2gJDIhErh5l8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 21:01:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<itLZ3gJDNuwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 21:02:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<khCN4wJDxuwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 21:03:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<wAh35QJDGnMI2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 21:04:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<QJQK6gJDJOAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 21:09:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<sMIM/AJDkpNn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 21:12:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<sLHDBgND7Nxo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 21:13:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<no20CwNDJMZK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 21:14:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<3FIuDQND5NotTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 21:17:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<BNiLGANDctII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 21:17:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<tuK5GANDfkkv9XzN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.234
country_id: 6252001
description:
Nov  7 21:17:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.234, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1r0rGQNDK1FBMQHq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.4.64
country_id: 6252001
description:
2025-11-07 21:17:31 dovecot_login authenticator failed for (140.82.4.64) [140.82.4.64]:38004: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Nov  7 21:17:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+kJAGgND4I1BMQHo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 21:18:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<OhARHgNDdI0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 21:20:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<YMTOIwNDetHBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 21:21:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<92eYJgNDaO0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 21:23:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<dFm+LgNDXJud5p7H>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.78
country_id: 6252001
description:
Nov  7 21:24:35 host2 pure-ftpd[3564791]: (?@205.210.31.78) [INFO] New connection from 205.210.31.78


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.184
country_id: 6252001
description:
Nov  7 21:31:56 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.104.184, lip=66.85.158.92, session=<dcMFTQND2KsUQGi4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-07 21:32:09 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:52818: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-07 21:31:55 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:35664: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 21:33:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oiQ0UQND5p+LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 21:34:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<5LJ+VwNDhoDRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 21:35:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<D7ANWgNDQK8vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 21:36:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<IvEuXQNDmKXIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.169.164.223
country_id: 6252001
description:
Nov  7 21:40:36 host2 sshd[3591198]: Disconnected from invalid user matin 20.169.164.223 port 40876 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.192.101
country_id: 6252001
description:
Nov  7 21:41:48 host2 pure-ftpd[3596372]: (?@20.65.192.101) [INFO] New connection from 20.65.192.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-07 21:42:54 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (menne) [196.47.172.253]:60568: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-07 21:42:58 dovecot_plain authenticator failed for (callust) [102.53.15.56]:50710: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 21:43:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1M/TdANDvs9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.24
country_id: 1861060
description:
Nov  7 21:42:33 host2 sshd[3597448]: Disconnected from invalid user portainer 163.44.99.24 port 36996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.169.164.223
country_id: 6252001
description:
Nov  7 21:42:46 host2 sshd[3597581]: Disconnected from invalid user kitchen 20.169.164.223 port 51214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.169.164.223
country_id: 6252001
description:
Nov  7 21:44:07 host2 sshd[3598984]: Disconnected from invalid user isaac 20.169.164.223 port 57966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 21:44:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<aBT4eQNDAOql0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 21:47:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<D8XpggNDHpyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 21:47:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<DQAggwNDwI8BFNmn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-11-07 21:47:33 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (sessives) [91.202.230.214]:44401: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.169.164.223
country_id: 6252001
description:
Nov  7 21:48:47 host2 sshd[3604262]: Disconnected from invalid user ubuntu 20.169.164.223 port 37910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 21:48:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<jSePhwNDcNFCYSpH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.117.213
country_id: 6252001
description:
Nov  7 21:50:12 host2 sshd[3605902]: Disconnected from invalid user ads1 165.227.117.213 port 33020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 21:50:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<q6rZjgNDKNY5gL/H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Nov  7 21:54:35 host2 sshd[3611166]: Disconnected from invalid user debian 8.213.197.49 port 48666 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 21:55:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<AGP5nwNDPosrh5l8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 21:54:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<jCrgnQND0Icv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 21:55:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<yDYMogND7OwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 21:57:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<h8pNpwNDxikI2zHw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.253
country_id: 1210997
description:
Nov  7 21:57:35 host2 sshd[3615130]: Disconnected from invalid user r00t 103.86.198.253 port 57577 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.117.213
country_id: 6252001
description:
Nov  7 21:58:33 host2 sshd[3616095]: Disconnected from invalid user user 165.227.117.213 port 44742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 21:59:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<h+bBrwNDDphn9Sd0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 22:00:50 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:58760: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.253
country_id: 1210997
description:
Nov  7 22:01:05 host2 sshd[3619113]: Disconnected from invalid user test1 103.86.198.253 port 33551 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-07 22:02:05 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:39177: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-07 22:01:43 dovecot_login authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:45676: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 22:01:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<jl13twNDfJAXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.253
country_id: 1210997
description:
Nov  7 22:04:28 host2 sshd[3623158]: Disconnected from invalid user znc 103.86.198.253 port 37762 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov  7 22:04:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS: Connection closed, session=<Mqg3wgNDcudChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 22:05:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<RdJixgNDPsRK0NqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  7 22:07:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<T+S8ywNDPpqLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 22:07:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<cFB/zAND5pItTSjg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-07 22:07:40 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:35702: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-07 22:07:54 dovecot_login authenticator failed for ([179.185.29.233]) [179.185.29.233]:40645: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 22:08:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<Tqz0zQNDPIBo7CMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 22:07:33 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64285: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-11-07 22:08:33 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:43196: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.133.4
country_id: 99237
description:
Nov  7 22:09:23 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=65.20.133.4, lip=66.85.158.91, session=<OKbB0gND46VBFIUE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 22:10:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:61205: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.42.124.234
country_id: 1269750
description:
Nov  7 22:10:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<careers>, method=PLAIN, rip=103.42.124.234, lip=66.85.158.91, TLS, session=<EF+K1ANDN4VnKnzq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 22:10:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<VGKw1gNDMIsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.67
country_id: 99237
description:
Nov  7 22:09:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=65.20.129.67, lip=66.85.158.91, TLS, session=<8q4W0wNDVthBFIFD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 22:11:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</NlM2gND9Ogv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.198.253
country_id: 1210997
description:
Nov  7 22:11:02 host2 sshd[3630765]: Disconnected from invalid user cmm 103.86.198.253 port 46178 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 22:11:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ADRS2QNDBOwv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 22:12:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<PMHx3ANDrtQv9XzN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 22:11:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:59902: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.198.253
country_id: 1210997
description:
Nov  7 22:12:39 host2 sshd[3632879]: Disconnected from invalid user postgres 103.86.198.253 port 34168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-07 22:13:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:52978: 535 Incorrect authentication data (set_id=kasun@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 51.68.25.8
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 51.68.25.8: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 22:15:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<OyxY6AND3qWd5p7H>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-11-07 22:21:15 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (teing) [174.58.87.108]:43116: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 22:26:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<CgRODwRDXp/RJpe/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 22:26:02 host2 sshd[3647653]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.198.102.252
country_id: 6252001
description:
Nov  7 22:27:15 host2 pure-ftpd[3648895]: (?@54.198.102.252) [INFO] New connection from 54.198.102.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 22:28:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<IAP/FQRD4kAvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 22:29:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<p9A+GgRD0KiLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 22:30:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<c66EHwRDHInBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 22:31:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<aexVIARDktXIMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov  7 22:31:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, session=<zvsSIgRDDIxKUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov  7 22:31:49 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS: Connection closed, session=<Wm4yIwRDED1KUi8D>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  7 22:32:59 host2 sshd[3654964]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  7 22:33:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<RaDyKQRDcOWi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 22:37:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<FKoAOARD5qOYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  7 22:38:06 host2 sshd[3660481]: Disconnected from invalid user user 2.57.121.25 port 6239 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 22:38:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<hbzROwRDzqYBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 22:40:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ahijQQRDGupnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-07 22:41:25 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (lente) [98.227.25.115]:50308: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 22:41:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<vqb3RQRDTKpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 22:44:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<pjydUQRDzsel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 22:49:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<e+7EYARD/uwzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 22:49:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<sVfIYgRD4OAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 22:49:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=<T2MMZARDYkArh5l8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-11-07 22:50:28 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:44992: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-07 22:50:56 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:56866: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 22:50:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<V32DZwRD3Mtn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 22:51:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<DOs/agRDJEII2zHw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  7 22:54:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=57.128.191.199, lip=66.85.158.91, session=<b0BldQRDirQ5gL/H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 22:55:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<ECwVdgRDQJ5K0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 22:58:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<pNfCggRDNsAtTSjg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  7 23:00:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SSMHiwRDXK4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-07 23:02:05 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:35328: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-11-07 23:01:46 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:43537: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov  7 23:02:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<YitokgRDRNsv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov  7 23:03:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<6L6PkgRD1LAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.35.20
country_id: 6252001
description:
Nov  7 23:04:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=104.236.35.20, lip=66.85.158.91, session=<ySFJlwRDIqdo7CMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.245.124.205
country_id: 1880251
description:
Nov  7 23:05:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=47.245.124.205, lip=66.85.158.91, session=<dAUhmwRDUJUv9XzN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Nov  7 23:05:14 host2 sshd[3692201]: Disconnected from invalid user ubuntu 8.213.197.49 port 34584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 23:05:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ZPiQnARDCtov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.158.199
country_id: 6252001
description:
Nov  7 23:07:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=157.230.158.199, lip=66.85.158.91, session=<FHRxowRDPPOd5p7H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.205
country_id: 6252001
description:
Nov  7 23:13:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.205, lip=66.85.158.91, session=</nOOtwRD74VBMQHN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov  7 23:13:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS: Connection closed, session=<ODxduARDLJ1BMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Nov  7 23:13:46 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, session=<h5o0uQRD8vpBMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.192
country_id: 2635167
description:
Nov  7 23:16:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.192, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<lGQuwQRD+d4jy9LA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  7 23:17:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<hliuxgRDtqvRJpe/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.192
country_id: 2635167
description:
Nov  7 23:16:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.192, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<skt4xARD7P4jy9LA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 159.255.144.35
country_id: 3175395
description:
Nov  7 23:18:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=159.255.144.35, lip=66.85.158.91, TLS, session=<6wNgxwRDp+Cf/5Aj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.124.58
country_id: 226074
description:
Nov  7 23:17:41 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=196.0.124.58, lip=66.85.158.91, TLS, session=<H50JxgRDC7TEAHw6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  7 23:20:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<VpIk0QRDxcsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  7 23:21:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<Y2L21ARDmq/IMGRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.192
country_id: 2635167
description:
Nov  7 23:22:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.192, lip=66.85.158.91, TLS, session=<AO6g2QRDeOQjy9LA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Nov  7 23:26:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<H8Vo5QRDOKSLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov  7 23:26:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<d9+55wRDyIHY2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Nov  7 23:27:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<k+OQ6gRDCpeYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-07 23:28:51 dovecot_plain authenticator failed for (nogroty) [102.53.15.17]:48516: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Nov  7 23:30:03 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, session=<lpJr8wRDeL6s7OTe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  7 23:30:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<3Pb19ARDXL0BFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  7 23:30:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<btB79QRDbK1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  7 23:35:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<de+vBQVDzJNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov  7 23:40:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<TojjFgVDOqQv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  7 23:40:39 host2 sshd[3729904]: Disconnected from invalid user hassan 122.8.184.4 port 55260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  7 23:41:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<iXE+HQVDHO0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov  7 23:42:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=193.151.137.207, lip=66.85.158.91, session=<dpcCHwVDapnBl4nP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.42.201
country_id: 6252001
description:
Nov  7 23:42:17 host2 sshd[3731575]: Disconnected from invalid user atul 172.245.42.201 port 54812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Nov  7 23:42:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<CXnGHwVDFNdn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  7 23:42:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<C5zgHwVD3NJK0NqG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:43:59 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0WBFJQVDuNgDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  7 23:43:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<0mw1JAVDUoSl0xnK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.14.254
country_id: 241170
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.134.14.254 - lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech.com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.9.77
country_id: 241170
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.134.9.77 - marketing "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user marketing (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.134.0.175
country_id: 241170
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.134.0.175 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.232.111
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 194.180.232.111 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  7 23:44:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=43.135.153.124, lip=66.85.158.91, session=</M3DJwVD5jErh5l8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.202.16.76
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 193.202.16.76 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.217.50
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 193.233.217.50 - administrator "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administrator (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.219.49.240
country_id: 1880251
description:
Nov  7 23:46:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=8.219.49.240, lip=66.85.158.91, session=<AyNMLgVD1gwI2zHw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:45:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<anjCKwVDQKcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:47:45 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LyG6MgVD2uoDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  7 23:48:22 host2 sshd[3738132]: Disconnected from invalid user support 122.8.184.4 port 38566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.77.40.224
country_id: 1880251
description:
Nov  7 23:49:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=45.77.40.224, lip=66.85.158.91, session=<ICXGNwVDiMAtTSjg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:49:07 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<7uafNwVDKIIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:49:50 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<CDsyOgVDcNoDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.42.201
country_id: 6252001
description:
Nov  7 23:50:21 host2 sshd[3740149]: Disconnected from invalid user root1 172.245.42.201 port 35962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  7 23:50:53 host2 sshd[3740829]: Disconnected from invalid user elasticuser 122.8.184.4 port 54820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:51:07 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jWDMPgVDjIQDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.42.201
country_id: 6252001
description:
Nov  7 23:51:56 host2 sshd[3742017]: Disconnected from invalid user tunneluser 172.245.42.201 port 49104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov  7 23:55:09 host2 sshd[3746103]: Disconnected from invalid user kent 144.31.194.75 port 52594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:54:28 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<QLfGSgVDFJADhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.194.75
country_id: 6252001
description:
Nov  7 23:56:17 host2 sshd[3747229]: Disconnected from invalid user fad 144.31.194.75 port 50600 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  7 23:56:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<rSrfUgVDVMsDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov  7 23:58:32 host2 sshd[3749588]: Disconnected from invalid user devops 144.31.194.75 port 49154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.194.75
country_id: 6252001
description:
Nov  8 00:00:48 host2 sshd[3751976]: Disconnected from invalid user showroom 144.31.194.75 port 58366 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov  8 00:02:44 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<yQhNaAVDQNlChJmO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.194.75
country_id: 6252001
description:
Nov  8 00:02:56 host2 sshd[3754182]: Disconnected from invalid user serv 144.31.194.75 port 33244 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 00:04:12 host2 sshd[3755965]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov  8 00:04:09 host2 sshd[3755925]: Disconnected from invalid user cod2server 158.178.141.16 port 59000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 00:03:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CWV1bAVD6pAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-08 00:04:00 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (conon) [98.193.112.85]:33802: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-08 00:04:04 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (slast) [73.230.86.50]:58474: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  8 00:06:29 host2 sshd[3758351]: Disconnected from invalid user admin 122.8.184.4 port 36980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  8 00:07:42 host2 sshd[3759710]: Disconnected from invalid user magda 122.8.184.4 port 57900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov  8 00:08:14 host2 sshd[3760302]: Disconnected from invalid user sa 158.178.141.16 port 23296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.8.184.4
country_id: 3996063
description:
Nov  8 00:08:54 host2 sshd[3761409]: Disconnected from invalid user atul 122.8.184.4 port 35206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-11-08 00:09:13 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:59038: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-08 00:09:23 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:35900: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov  8 00:09:46 host2 sshd[3762271]: Disconnected from invalid user ahmed 158.178.141.16 port 29186 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 00:11:04 host2 sshd[3763863]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Nov  8 00:11:24 host2 sshd[3764131]: Disconnected from invalid user sander 158.178.141.16 port 64014 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.80.89
country_id: 6252001
description:
Nov  8 00:12:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.80.89, lip=66.85.158.91, session=<hKTDigVDNq8UDlBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.31
country_id: 6252001
description:
Nov  8 00:12:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.31, lip=66.85.158.92, session=<DeZUiwVDWsMNWX0f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 00:14:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<3wsOkwVDENSi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.102
country_id: 3469034
description:
Nov  8 00:15:43 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.44.96.102, lip=66.85.158.91, TLS, session=<3c6ulQVDccWxLGBm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.111.114
country_id: 3469034
description:
Nov  8 00:16:06 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.85.111.114, lip=66.85.158.91, TLS, session=<JvbplgVDyYS7VW9y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-11-08 00:17:06 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:37730: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-08 00:18:09 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (manking) [174.59.253.88]:33076: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 00:17:24 host2 sshd[3770542]: Disconnected from invalid user user 2.57.121.25 port 19053 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Nov  8 00:30:28 host2 sshd[3784713]: Disconnected from invalid user ubuntu 43.154.195.142 port 38494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  8 00:32:31 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<fOHa0gVDwpYDhBfJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 43.153.111.80
country_id: 6252001
description:
Nov  8 00:33:25 host2 pure-ftpd[3787549]: (?@43.153.111.80) [INFO] New connection from 43.153.111.80


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.153.111.80
country_id: 6252001
description:
Nov  8 00:33:27 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=43.153.111.80, lip=66.85.158.91, session=<GZIn1gVDpu0rmW9Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  8 00:34:44 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<xsTE2gVDjKIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov  8 00:35:50 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Beqv3gVDOLADhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Nov  8 00:36:15 host2 sshd[3790598]: Disconnected from invalid user gpadmin 137.59.55.50 port 45874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.119.165
country_id: 6252001
description:
Nov  8 00:36:33 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.119.165, lip=66.85.158.92, session=<hF9I4QVDljCs7Hel>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Nov  8 00:39:15 host2 sshd[3794020]: Disconnected from invalid user marcus 137.59.55.50 port 53532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.195.142
country_id: 1819730
description:
Nov  8 00:40:28 host2 sshd[3795700]: Disconnected from invalid user django 43.154.195.142 port 57406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-08 00:43:01 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:51126: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.246.180
country_id: 1880251
description:
Nov  8 00:46:47 host2 sshd[3803167]: Disconnected from invalid user mario 43.160.246.180 port 48902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 00:48:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64603: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.246.180
country_id: 1880251
description:
Nov  8 00:52:49 host2 sshd[3809412]: Disconnected from invalid user zahid 43.160.246.180 port 45030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-08 00:55:01 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:46435: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-08 00:54:47 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:34098: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.160.246.180
country_id: 1880251
description:
Nov  8 00:56:15 host2 sshd[3813395]: Disconnected from invalid user woc 43.160.246.180 port 37588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.246.180
country_id: 1880251
description:
Nov  8 00:59:43 host2 sshd[3816964]: Disconnected from invalid user test01 43.160.246.180 port 49730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.246.180
country_id: 1880251
description:
Nov  8 01:03:14 host2 sshd[3821383]: Disconnected from invalid user linda 43.160.246.180 port 56008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.17
country_id: 6252001
description:
Nov  8 01:07:47 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.133.17, lip=66.85.158.92, session=<5vz4UAZDROeTuYUR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 01:07:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=</598UQZDBMzRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 01:08:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<m70yUwZDYjmYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.57.181.41
country_id: 6252001
description:
Nov  8 01:08:30 host2 sshd[3827432]: Disconnected from invalid user workspace 34.57.181.41 port 57752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 01:08:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ebjTUwZDGJAXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 01:09:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<PQOiVgZDNLIBFNmn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.205
country_id: 6252001
description:
Nov  8 01:09:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pWEfVwZDm9/G6xjN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov  8 01:10:32 host2 sshd[3829912]: Disconnected from invalid user odoo15 37.255.249.201 port 56366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.19
country_id: 1880251
description:
Nov  8 01:10:47 host2 sshd[3830222]: Disconnected from invalid user user1 45.78.219.19 port 57730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 01:10:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<LdUhXAZD+MdK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 01:12:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<z/NWYAZDWfO2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 01:12:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<e4aWYAZDouhK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 01:11:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<i67gXwZDus2zALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 01:12:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<vjHQYgZDwKid5hjP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.110.126.10
country_id: 1522867
description:
Nov  8 01:12:23 host2 sshd[3831893]: Disconnected from invalid user admin 176.110.126.10 port 39090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Nov  8 01:12:29 host2 sshd[3831946]: Disconnected from invalid user agenda 223.17.0.220 port 47428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov  8 01:13:18 host2 sshd[3832846]: Disconnected from invalid user bandit 37.255.249.201 port 52794 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Nov  8 01:13:28 host2 sshd[3833045]: Disconnected from invalid user user 95.85.114.218 port 47056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.37.66
country_id: 3932488
description:
Nov  8 01:13:38 host2 sshd[3833183]: Disconnected from invalid user bandit 161.132.37.66 port 53176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Nov  8 01:13:55 host2 sshd[3833489]: Disconnected from invalid user ftpuser 223.17.0.220 port 37930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-08 01:13:30 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:55928: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-08 01:13:36 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:55180: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.110.126.10
country_id: 1522867
description:
Nov  8 01:13:45 host2 sshd[3833282]: Disconnected from invalid user testuser 176.110.126.10 port 39068 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.107
country_id: 1819730
description:
Nov  8 01:14:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.107, lip=66.85.158.92, TLS handshaking: Connection closed, session=<c9e3aAZDWpwtjppr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.57.181.41
country_id: 6252001
description:
Nov  8 01:14:17 host2 sshd[3833897]: Disconnected from invalid user hamza 34.57.181.41 port 37728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 01:14:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<HdlpaAZDXBAv7AMK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-08 01:14:37 dovecot_plain authenticator failed for (gyngly) [81.0.54.119]:54720: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.57.181.41
country_id: 6252001
description:
Nov  8 01:15:26 host2 sshd[3835284]: Disconnected from invalid user alfresco 34.57.181.41 port 37726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Nov  8 01:15:42 host2 sshd[3835498]: Disconnected from invalid user teste 103.255.147.244 port 50576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.57.181.41
country_id: 6252001
description:
Nov  8 01:16:33 host2 sshd[3836370]: Disconnected from invalid user rdp 34.57.181.41 port 37406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 01:16:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</s3GcAZDGilniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.39
country_id: 1819730
description:
Nov  8 01:16:48 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=<H4k8cQZDNqwtjpon>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-08 01:17:10 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (peneocyng) [81.226.88.121]:39082: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Nov  8 01:17:29 host2 sshd[3837369]: Disconnected from invalid user bandit 167.99.49.89 port 36274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.255.249.201
country_id: 130758
description:
Nov  8 01:17:49 host2 sshd[3837681]: Disconnected from invalid user postgres 37.255.249.201 port 45330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 01:17:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<MZU7cwZDaM9D2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.54.19
country_id: 3932488
description:
Nov  8 01:17:36 host2 sshd[3837451]: Disconnected from invalid user admin 161.132.54.19 port 34914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Nov  8 01:18:39 host2 sshd[3838638]: Disconnected from invalid user login 103.255.147.244 port 60668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Nov  8 01:19:39 host2 sshd[3839659]: Disconnected from invalid user login 167.99.49.89 port 41416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Nov  8 01:21:05 host2 sshd[3841691]: Disconnected from invalid user dockeruser 117.216.143.31 port 41358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.54.19
country_id: 3932488
description:
Nov  8 01:21:11 host2 sshd[3841803]: Disconnected from invalid user sunil 161.132.54.19 port 55938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 01:22:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<1vOsgwZDLJ4vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.25
country_id: 798544
description:
Nov  8 01:22:13 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=31.222.12.25, lip=66.85.158.91, TLS, session=<gtp5gwZDWscf3gwZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.110.126.10
country_id: 1522867
description:
Nov  8 01:21:37 host2 sshd[3842238]: Disconnected from invalid user ftpuser 176.110.126.10 port 39004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 01:22:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<D1CJhQZDTupnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.211.189
country_id: 3865483
description:
Nov  8 01:22:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.1.211.189, lip=66.85.158.91, TLS, session=<drWyhAZDN8W6AdO9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.54.19
country_id: 3932488
description:
Nov  8 01:22:47 host2 sshd[3843645]: Disconnected from invalid user test4 161.132.54.19 port 33674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 01:23:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<TL+xiAZDPo1D2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.110.126.10
country_id: 1522867
description:
Nov  8 01:24:21 host2 sshd[3845430]: Disconnected from invalid user maman 176.110.126.10 port 38992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 01:24:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<UdD5jAZDbqCPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Nov  8 01:25:10 host2 sshd[3846481]: Disconnected from invalid user django 223.17.0.220 port 44118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
country_id: 2661886
description:
2025-11-08 01:25:41 dovecot_plain authenticator failed for 95.209.141.145.bredband.tre.se (shionne) [95.209.141.145]:58982: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 01:25:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XY/pkAZD8NZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-08 01:25:45 dovecot_plain authenticator failed for (gloths) [94.201.22.158]:42681: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Nov  8 01:26:34 host2 sshd[3848085]: Disconnected from invalid user starbound 223.17.0.220 port 51982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.54.19
country_id: 3932488
description:
Nov  8 01:27:09 host2 sshd[3848779]: Disconnected from invalid user sinusbot 161.132.54.19 port 57466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.19
country_id: 1880251
description:
Nov  8 01:27:18 host2 sshd[3848923]: Disconnected from invalid user john 45.78.219.19 port 43092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 01:27:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1GWAlwZDlOOPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.163.249
country_id: 1880251
description:
Nov  8 01:28:16 host2 sshd[3849975]: Disconnected from invalid user sinusbot 101.47.163.249 port 33670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-11-08 01:28:28 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (undinive) [98.192.74.183]:52404: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 01:28:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<+rblmgZDSI1m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 01:29:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<lG2WnQZDbqgz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.140
country_id: 1880251
description:
Nov  8 01:29:50 host2 sshd[3851850]: Disconnected from invalid user mcuser 101.47.49.140 port 40962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 01:29:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<6ZXPnwZDdtKP9IUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.160.197.229
country_id: 130758
description:
Nov  8 01:31:25 host2 sshd[3853893]: Disconnected from invalid user gespinoza 5.160.197.229 port 63780 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 01:31:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<h2BypgZDnkCYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Nov  8 01:31:49 host2 sshd[3854408]: Disconnected from invalid user ts3 118.193.43.244 port 41434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 01:32:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<lwMeqQZD9J6OtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Nov  8 01:32:47 host2 sshd[3855326]: Disconnected from invalid user sinusbot 117.216.143.31 port 44306 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 01:33:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<eeD4rAZDqLdnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 01:34:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<8XAfsAZDrMYr4TT5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.244
country_id: 1819730
description:
Nov  8 01:34:45 host2 sshd[3857696]: Disconnected from invalid user cso 118.193.43.244 port 38794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.227
country_id: 1880251
description:
Nov  8 01:35:38 host2 sshd[3858848]: Disconnected from invalid user Azure 45.78.216.227 port 46908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 01:36:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<yUHwuAZDkqSxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 01:36:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<7/sWuQZDQxAvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.37.66
country_id: 3932488
description:
Nov  8 01:37:10 host2 sshd[3860715]: Disconnected from invalid user vijay 161.132.37.66 port 45410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov  8 01:36:24 host2 sshd[3859638]: Disconnected from invalid user vpn 79.106.102.70 port 51006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 01:37:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<qFqUugZDVMhCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 01:37:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<ZxWIuwZDGutm1PbI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Nov  8 01:37:40 host2 sshd[3861282]: Disconnected from invalid user postgres 118.193.43.244 port 50570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.19
country_id: 1880251
description:
Nov  8 01:37:42 host2 sshd[3861216]: Disconnected from invalid user postgres 45.78.219.19 port 37828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 01:37:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<H9xrvAZDIpVIPGU3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 01:38:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<5FPuvwZDmttm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 01:39:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<zHd/wAZDfLUrmxBp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.106.102.70
country_id: 783754
description:
Nov  8 01:39:29 host2 sshd[3863269]: Disconnected from invalid user es 79.106.102.70 port 59084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 01:40:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<41PqxQZDoNsv/WCP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov  8 01:40:46 host2 sshd[3864882]: Disconnected from invalid user sumit 79.106.102.70 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov  8 01:42:04 host2 sshd[3866551]: Disconnected from invalid user user1 79.106.102.70 port 45508 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 01:41:48 host2 sshd[3866158]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-11-08 01:42:23 dovecot_plain authenticator failed for (indecifid) [65.20.164.137]:47525: 535 Incorrect authentication data (set_id=support@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 01:43:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<xDSK0AZDpozRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 01:44:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<yysV0wZDto0vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 01:44:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<Ho900wZDTuNK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 01:45:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<4Nli2QZDghdn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 01:46:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<MjKx2QZD4pcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 01:47:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<efwn3QZDYKuc7uBS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.216.227
country_id: 1880251
description:
Nov  8 01:46:16 host2 sshd[3871848]: Disconnected from invalid user tony 45.78.216.227 port 51592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Nov  8 01:46:18 host2 sshd[3871878]: Disconnected from invalid user gu 117.216.143.31 port 60590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.160.197.229
country_id: 130758
description:
Nov  8 01:47:45 host2 sshd[3873538]: Disconnected from invalid user ads 5.160.197.229 port 65148 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 01:48:40 host2 sshd[3874521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.236.19
country_id: 1269750
description:
Nov  8 01:48:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=31.97.236.19, lip=66.85.158.91, session=<opN04gZDOp0fYewT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.160.197.229
country_id: 130758
description:
Nov  8 01:49:08 host2 sshd[3875212]: Disconnected from invalid user operador 5.160.197.229 port 65276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 01:50:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Bcy46gZDep4v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 01:51:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<xwnC7QZD2OEBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 01:51:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<bFTk7QZDpLxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 01:51:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<yoYX7gZDXO0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 01:51:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<+sv87AZD/rmUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 01:52:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<rB737gZDnLSi8JQo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.246
country_id: 1880251
description:
Nov  8 01:52:44 host2 sshd[3879460]: Disconnected from invalid user alex 101.47.141.246 port 54702 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  8 01:52:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<Eh438gZDHqOSO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.204.35
country_id: 1269750
description:
Nov  8 01:55:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=72.60.204.35, lip=66.85.158.91, session=<uu+o+gZDUKpIPMwj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 01:55:34 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<m9nZ+wZDpMcDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 01:56:18 host2 sshd[3885031]: Disconnected from invalid user user 2.57.121.25 port 54109 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 01:57:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<NXV5AgdDKsNn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 01:57:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<FM4hAwdDILWxiOOT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 01:57:51 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<fwULBAdDztcDhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov  8 01:59:22 host2 pure-ftpd[3888473]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 01:59:29 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<0o7WCQdDJrUDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 02:00:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<PHrhDQdDiqZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 02:00:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<ae3+DgdD8Lel0xnK>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 02:00:18 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<dlrIDAdD5rQDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 02:01:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<leyNEAdDjOGl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 02:01:45 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Yf30EQdD1o8DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 02:03:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<AsxhFgdDctXRJpe/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 02:02:42 host2 dovecot[3154217]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<1hBgFQdD0LwDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 02:03:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<APRAFwdDMluYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 02:03:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<9oavGAdDtpsv7AMK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov  8 02:04:07 host2 dovecot[3154217]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<3flwGgdDOIYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-08 02:05:03 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (colonappro) [73.195.211.98]:34202: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.163.249
country_id: 1880251
description:
Nov  8 02:05:38 host2 sshd[3896028]: Disconnected from invalid user gu 101.47.163.249 port 58580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 02:05:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<LNYkIAdDOItK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 02:05:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=</Cx7HgdDStW2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 02:05:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<wMR3HgdDus6d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 02:06:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<yopFIgdDyJYvT+mI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.213
country_id: 1880251
description:
Nov  8 02:07:18 host2 sshd[3897876]: Disconnected from invalid user admin 45.78.219.213 port 55870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 02:07:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<xGRnJwdDTNpK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 02:11:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<r4qlMwdDrt+zALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 02:12:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<BvU+OAdD4pxD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 02:12:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<iei7OAdDXmIv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Nov  8 02:12:43 host2 sshd[3903786]: Disconnected from invalid user tmp 50.6.193.137 port 54430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-08 02:12:59 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:37936: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-08 02:13:12 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:44675: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-08 02:13:35 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:57832: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 02:14:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<lLIfQAdD8L4XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.219.213
country_id: 1880251
description:
Nov  8 02:15:01 host2 sshd[3906105]: Disconnected from invalid user dockeruser 45.78.219.213 port 44314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Nov  8 02:15:23 host2 sshd[3906744]: Disconnected from invalid user admin 50.6.193.137 port 36880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 02:15:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<vw1wRAdD9URniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.193.137
country_id: 6252001
description:
Nov  8 02:16:36 host2 sshd[3908193]: Disconnected from invalid user frappe-user 50.6.193.137 port 44854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 02:17:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<9fQiSgdD8LUvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 02:18:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<WEEZTgdDMqRD2fSf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Nov  8 02:18:59 host2 sshd[3910716]: Disconnected from invalid user dimas 50.6.193.137 port 49600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 02:19:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<tripTwdDMtePbtX3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 02:20:27 host2 sshd[3912672]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 02:20:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<TxmCVAdDhOhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.50.246
country_id: 1643084
description:
Nov  8 02:22:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=31.97.50.246, lip=66.85.158.91, session=<VmuMWgdDLLMfYTL2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.241.134.107
country_id: 6252001
description:
Nov  8 02:21:24 host2 sshd[3913807]: Disconnected from invalid user debian 192.241.134.107 port 52500 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.67
country_id: 6252001
description:
Nov  8 02:21:46 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nCSMWQdDxd+TuYRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 02:21:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<mJQ3WgdDSKWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 02:22:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<V5f7WwdDH9kz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 02:22:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ZkLzWwdDEImP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-08 02:24:13 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:49207: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 02:23:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<mNbXXgdDRLtnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.107
country_id: 6252001
description:
Nov  8 02:23:33 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=199.45.155.107, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<b1z0XwdDGNnHLZtr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-08 02:24:28 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:43094: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.223
country_id: 1880251
description:
Nov  8 02:25:57 host2 sshd[3918920]: Disconnected from invalid user zhou 101.47.50.223 port 44058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 02:26:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<P9qTaQdDbNBm1bVi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.246
country_id: 1880251
description:
Nov  8 02:27:26 host2 sshd[3920465]: Disconnected from invalid user roman 101.47.141.246 port 59634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 02:28:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<YvH3cgdDTmOYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 02:28:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<0IgacwdDTuovT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-08 02:29:05 dovecot_plain authenticator failed for (skywaray) [64.72.74.162]:54472: 535 Incorrect authentication data (set_id=support@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.112.193.210
country_id: 3017382
description:
Nov  8 02:29:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=92.112.193.210, lip=66.85.158.91, session=<Xr69dAdDVrBccMHS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 02:29:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<83zvdQdDZMUvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.134.107
country_id: 6252001
description:
Nov  8 02:30:32 host2 sshd[3923823]: Disconnected from invalid user ronald 192.241.134.107 port 59934 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 02:31:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<4fzQewdDxs1noNQc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.18.109
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.249.18.109 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 02:32:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<70p+fgdDdMgr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 02:32:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<QGJnfwdD0o5m1PbI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.50.223
country_id: 1880251
description:
Nov  8 02:34:01 host2 sshd[3927191]: Disconnected from invalid user apt 101.47.50.223 port 52966 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 02:35:06 host2 sshd[3928033]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 02:34:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<LUk8iAdDSq8rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.246
country_id: 1880251
description:
Nov  8 02:34:52 host2 sshd[3927833]: Disconnected from invalid user steam 101.47.141.246 port 56310 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 145.223.20.239
country_id: 1269750
description:
Nov  8 02:34:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=145.223.20.239, lip=66.85.158.91, session=<WbJgiAdDxtWR3xTv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 02:35:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<bIz7iQdDvrMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 02:36:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<PMiJjAdDno2xiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 02:36:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<jxu4jgdDgLBCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 02:36:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<ilNyjwdDXKcBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 02:36:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<9gqFjwdD5KBm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 02:38:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<OljPkwdD2KbRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.117.10
country_id: 226074
description:
Nov  8 02:40:50 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=196.0.117.10, lip=66.85.158.91, TLS, session=<s6GHnAdDKbPEAHUK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.28
country_id: 3175395
description:
Nov  8 02:41:08 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.28, lip=66.85.158.91, TLS, session=<SavUnQdDLKe5D6sc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov  8 02:40:50 host2 sshd[3934200]: Disconnected from invalid user sonar 156.236.75.209 port 37218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.50.223
country_id: 1880251
description:
Nov  8 02:42:06 host2 sshd[3935498]: Disconnected from invalid user zhangyue 101.47.50.223 port 60224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 02:43:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<vQuJpQdDqJic7uBS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.209
country_id: 1819730
description:
Nov  8 02:42:26 host2 sshd[3935784]: Disconnected from invalid user user 156.236.75.209 port 52400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 02:42:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<DciAowdDioBK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 02:42:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<yztLpQdDzMIrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 02:44:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<1t65qgdDeMkv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 02:46:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ghqBsAdDkIyP9IUv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 02:45:48 host2 sshd[3939450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  8 02:46:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<ey3KsQdDVNySO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov  8 02:47:09 host2 sshd[3940958]: Disconnected from invalid user user1 156.236.75.209 port 39392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 02:47:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<tQrjtgdDiO0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 02:48:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<f3dCuQdDMq1nJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov  8 02:48:39 host2 sshd[3942454]: Disconnected from invalid user jarservice 156.236.75.209 port 58264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 02:49:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<YrKnuwdD3siUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 02:51:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<qZ8GwgdDYudnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 02:51:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=</Mh8wwdDepcvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 02:52:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<Gd3bxwdD4pRnPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 02:53:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<u04XywdDdtNn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.75
country_id: 1880251
description:
Nov  8 02:55:52 host2 sshd[3951282]: Disconnected from invalid user admin 101.47.161.75 port 55714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 02:57:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<kRry1wdDYoGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 02:57:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ufF/2QdD8LO2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 02:57:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<wcTL2QdDdtlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 02:57:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<v6wF2gdDks6d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 02:58:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<S0if2wdDwNal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 02:58:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<VVxu3AdDIunRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 02:58:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<ZDJr3AdDMLNn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 03:00:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<cgPO5AdDgn6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 03:01:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<fJIp5wdD9OSl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.49
country_id: 2635167
description:
Nov  8 03:02:29 host2 dovecot[3154217]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.49, lip=66.85.158.91, TLS, session=<E98l6wdDP5O594kx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 03:02:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<nk4g7AdD6PYv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 03:04:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<zGq58AdDOKRK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 03:05:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<QfJF9QdD3pNK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.112.193.210
country_id: 3017382
description:
Nov  8 03:06:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=92.112.193.210, lip=66.85.158.91, session=<pJfo+gdDOo5ccMHS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-08 03:07:41 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 03:08:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<nDI8/wdDfo1D2fSf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.85.44.195
country_id: 6252001
description:
[2025-11-08 03:09:05 +0530] info [cpaneld] 73.85.44.195 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.141.220.79
country_id: 6252001
description:
[2025-11-08 03:09:04 +0530] info [cpaneld] 76.141.220.79 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.225.198.31
country_id: 6252001
description:
[2025-11-08 03:09:10 +0530] info [cpaneld] 63.225.198.31 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-08 03:08:25 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60186: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.151.27.206
country_id: 6252001
description:
[2025-11-08 03:09:15 +0530] info [whostmgrd] 73.151.27.206 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.88.93.245
country_id: 6252001
description:
[2025-11-08 03:09:22 +0530] info [cpaneld] 172.88.93.245 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.227.109.230
country_id: 6252001
description:
[2025-11-08 03:09:26 +0530] info [cpaneld] 162.227.109.230 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.168.236.6
country_id: 6252001
description:
[2025-11-08 03:09:29 +0530] info [cpaneld] 76.168.236.6 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 03:10:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<6lPTBghDAL+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 03:10:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<963QBwhD1sGzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 03:11:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<4FeFCwhDNrwv7AMK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.187.149
country_id: 6252001
description:
[2025-11-08 03:13:03 +0530] info [cpaneld] 76.32.187.149 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 03:13:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7Ir5EAhD3h1niu0S>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.209.197.179
country_id: 6252001
description:
[2025-11-08 03:13:00 +0530] info [cpaneld] 47.209.197.179 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.235.28.88
country_id: 6252001
description:
[2025-11-08 03:13:01 +0530] info [cpaneld] 108.235.28.88 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 03:13:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<kzDIEAhDaJ2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.161.75
country_id: 1880251
description:
Nov  8 03:12:15 host2 sshd[3969418]: Disconnected from invalid user ubuntu 101.47.161.75 port 50364 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.151.97.57
country_id: 6252001
description:
[2025-11-08 03:13:08 +0530] info [whostmgrd] 69.151.97.57 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.120.103.23
country_id: 6252001
description:
[2025-11-08 03:13:19 +0530] info [cpaneld] 149.120.103.23 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 03:13:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<RGdcEghD/uAvT+mI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.145.5.19
country_id: 6252001
description:
[2025-11-08 03:13:13 +0530] info [cpaneld] 67.145.5.19 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.164.10.196
country_id: 6252001
description:
[2025-11-08 03:13:20 +0530] info [cpaneld] 67.164.10.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 03:14:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<BYo8FQhD0qFD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 03:15:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<lQsEGwhDRIGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 03:16:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<IyqSHAhDjZ0z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 03:17:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<HNn+HghD4JovT1jH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.161.75
country_id: 1880251
description:
Nov  8 03:17:42 host2 sshd[3975038]: Disconnected from invalid user user1 101.47.161.75 port 58742 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 03:19:03 host2 sshd[3976702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 03:18:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<LqgQJAhDYtZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 03:20:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TXNcKghDapxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 03:20:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</XnALAhDuuwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 03:22:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<WHniMQhDfNsBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 03:22:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<ZifGMwhDkIEvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-08 03:23:43 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:37640: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-08 03:24:18 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:35358: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 03:24:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<cu0lOghD7MFm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 03:25:54 host2 sshd[3984238]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 03:26:20 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UANcQAhDlIaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 03:27:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<x/L1QghD3qBm1PbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-08 03:28:32 dovecot_plain authenticator failed for (podefrel) [24.187.213.29]:37348: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 03:29:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<MGclSwhDsJZnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 03:29:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<ECNETAhDtKIr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 03:31:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<upwDUQhDwr4rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-08 03:31:06 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (quings) [73.213.236.66]:46582: 535 Incorrect authentication data (set_id=support@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-08 03:31:11 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:52015: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 03:30:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<kVNMTghD5ogv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.112.193.210
country_id: 3017382
description:
Nov  8 03:30:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=92.112.193.210, lip=66.85.158.91, session=<LT/cTwhD4MNccMHS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-08 03:31:35 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:49240: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 03:32:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<EZYtVghDcujRJvZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-08 03:34:21 dovecot_login authenticator failed for ([182.95.51.166]) [182.95.51.166]:55096: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-08 03:34:33 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:52698: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 03:35:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<ZkuFXwhDetWi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 03:35:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<QsO6XwhDCNlCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 03:35:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<mVBhYAhDaN9m1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 03:35:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<VLcLYQhDqOsvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.154.24.3
country_id: 798544
description:
Nov  8 03:35:32 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=94.154.24.3, lip=66.85.158.91, TLS, session=<lKJgYAhD++BemhgD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.133
country_id: 3469034
description:
Nov  8 03:35:14 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=186.209.246.133, lip=66.85.158.91, TLS, session=<7Tw/XwhDVJe60faF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 03:35:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<qRlZYAhD9sexiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 03:38:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<Shw0aghDIIcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  8 03:38:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<URlkaghD0piSO+QY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 03:38:38 host2 sshd[3999814]: Disconnected from invalid user shemar 62.60.131.157 port 39191 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 03:39:36 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<BI7KbwhDVJ6c7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 03:39:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<xXjScAhDHI4rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 03:40:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<OrhOcwhDWM6P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 03:40:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<5lSHcwhDmJhIPGU3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 03:42:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<gKileQhD3O0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 03:43:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<kcPqewhD7rxK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 03:45:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<+g1JhQhDKINnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 03:47:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<9VgSjAhDpt5nVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 03:47:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<YgZ9iwhDAsmUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 03:49:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<uRNhkwhD9uNn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 03:50:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<YJaLlwhDiNqd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 03:50:57 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<nQpimAhDRni2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 03:50:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<67t0mAhDeqBnPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 03:53:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<wQ/znwhDKOPRJpe/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-11-08 03:53:07 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:32968: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 03:55:16 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<DZzRpwhDHOql6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 03:54:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+bq9pghDeNhA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 03:56:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<NmPZrAhDENaxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 03:57:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<U35IsQhDZIsvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 03:57:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<e4p3sQhDMKGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 04:01:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<bHZMvAhDxk8v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 04:00:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<sQxvughD6KdK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 04:03:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<adG6xAhDcKuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.82.13
country_id: 597427
description:
Nov  8 04:04:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=69.62.82.13, lip=66.85.158.91, session=<9AzNxwhDDqpFPlIN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 04:04:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<QhTZyAhDYoZD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 04:06:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MONnzwhDYKmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 04:07:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<Fr6g0ghDTOI+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 04:07:26 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<lMtN0whDkMpK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 04:08:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<R8ev1QhDyKEBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 04:09:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<+lYU2QhDNs2l0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:09:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Mb+L2ghDTLIDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 04:09:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<mOuE2whDOhUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 04:10:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<ZN0K3QhDltuzALHl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-08 04:10:48 dovecot_plain authenticator failed for (choreacel) [65.20.191.12]:40591: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 04:10:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<sEZZ3whDqIhD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 04:11:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<0Y494AhDLQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 04:10:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<z2713ghD09Ez0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:10:43 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ZTAx3whDSKUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 04:11:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<jK494whDdBFn09oq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:12:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<HU3v4whDFr8DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 04:12:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=</j+k5AhDqIaP9IUv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.175
country_id: 6252001
description:
Nov  8 04:14:14 host2 pure-ftpd[4049657]: (?@198.235.24.175) [INFO] New connection from 198.235.24.175


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:13:27 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<w6r36AhDoJoDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov  8 04:14:32 host2 sshd[4049964]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 64802


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:14:20 host2 dovecot[3154217]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<r7Qi7AhDTMIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:15:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<pDs18QhD2OcDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 04:16:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<n+c+9AhDDJJnoNQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:16:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Neho9AhDSOEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 04:17:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<wvHj9QhDHEAvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  8 04:17:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<uGYB+QhDqrIDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-08 04:18:26 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 04:18:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LtAO/AhDxs1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 04:20:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<n9QkAQlDWLAvT+mI>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.66
country_id: 2635167
description:
Nov  8 04:20:42 host2 dovecot[3154217]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.66, lip=66.85.158.92, TLS, session=<c/vlAglDJc2594lC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 04:22:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<3hipBwlDCrNm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 04:22:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<nPnZCglDiLdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 04:23:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<2UaGDQlDaKmYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 04:25:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<MQF0EglDJJ0+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 04:25:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<ZQT+FAlDSLsv/WCP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.115.3.148
country_id: 6252001
description:
[2025-11-08 04:26:42 +0530] info [cpaneld] 161.115.3.148 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.144.134
country_id: 6252001
description:
[2025-11-08 04:26:57 +0530] info [whostmgrd] 76.171.144.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.202.200.38
country_id: 6252001
description:
[2025-11-08 04:27:05 +0530] info [cpaneld] 97.202.200.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.33.68
country_id: 6252001
description:
[2025-11-08 04:27:14 +0530] info [cpaneld] 172.59.33.68 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.61.47.129
country_id: 6252001
description:
[2025-11-08 04:26:40 +0530] info [cpaneld] 67.61.47.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.41.158.242
country_id: 6252001
description:
[2025-11-08 04:26:50 +0530] info [cpaneld] 96.41.158.242 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 04:26:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<b6LSGAlDMLXRJvZG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.234.80
country_id: 6252001
description:
[2025-11-08 04:26:59 +0530] info [cpaneld] 73.241.234.80 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 04:27:21 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<V3B9GglDaMEXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 04:27:28 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<am76GglDAMhnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 04:27:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<U/1dGwlDKoMr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 04:27:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<w79NHAlDWssrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.113
country_id: 690791
description:
Nov  8 04:30:37 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=176.103.1.113, lip=66.85.158.91, TLS, session=<fwlnJQlDGeSwZwFx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.196.171
country_id: 3865483
description:
Nov  8 04:31:05 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=186.96.196.171, lip=66.85.158.91, TLS, session=<5W3FJglDsoa6YMSr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 04:33:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<uWcZLwlDUNEv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 04:33:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<xerCMQlDjNVCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  8 04:34:03 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.59.228.24, lip=66.85.158.91, session=<QeOHMglDvt6SO+QY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 04:33:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<XoN6MQlD2KVm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 04:35:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<slstNglDIMixiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  8 04:35:10 host2 sshd[4077400]: Disconnected from invalid user user 2.57.121.25 port 54049 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 04:35:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<h7bNOAlDsuCc7uBS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-08 04:35:56 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53681: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 04:37:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<SKCqPQlDSuArZDwA>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.108.182
country_id: 6252001
description:
[2025-11-08 04:37:10 +0530] info [cpaneld] 172.59.108.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.12.2
country_id: 6252001
description:
[2025-11-08 04:36:50 +0530] info [cpaneld] 76.86.12.2 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.10.112.141
country_id: 6252001
description:
[2025-11-08 04:36:54 +0530] info [cpaneld] 98.10.112.141 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.33.35.52
country_id: 6252001
description:
[2025-11-08 04:36:57 +0530] info [cpaneld] 100.33.35.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.125.252
country_id: 6252001
description:
[2025-11-08 04:36:59 +0530] info [whostmgrd] 76.90.125.252 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.218.220.218
country_id: 6252001
description:
[2025-11-08 04:37:01 +0530] info [cpaneld] 162.218.220.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.93.105.210
country_id: 6252001
description:
[2025-11-08 04:37:04 +0530] info [cpaneld] 71.93.105.210 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov  8 04:37:53 host2 sshd[4080228]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58967


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 04:37:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<txNaPwlDsoqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 04:40:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<bneiSAlDIO4zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 04:40:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<HshGSwlD+OaOtOyP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 04:42:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<HhqSTwlDHqIvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 04:43:04 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<oLfAUglD9rhnJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.183.138
country_id: 1880251
description:
Nov  8 04:45:13 host2 sshd[4088216]: Disconnected from invalid user azure 128.199.183.138 port 50330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 04:45:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<C5e2XAlDFK2UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 04:46:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<6/keXglD5nu2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 04:45:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<0y2vWglDNtvRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 04:46:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<RMs5XwlDKqad5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 04:46:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<rUUoYAlDurRnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Nov  8 04:47:04 host2 sshd[4090214]: Disconnected from invalid user debian 172.245.45.194 port 49936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 04:47:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<GRWQYQlDbodK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.183.138
country_id: 1880251
description:
Nov  8 04:47:17 host2 sshd[4090342]: Disconnected from invalid user wallabag 128.199.183.138 port 57372 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.45.194
country_id: 6252001
description:
Nov  8 04:48:18 host2 sshd[4091335]: Disconnected from invalid user jani 172.245.45.194 port 50062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 04:48:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<X6EjZwlDCoZn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-08 04:51:17 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:39028: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.212.182.128
country_id: 6252001
description:
Nov  8 04:50:18 host2 sshd[4093329]: Disconnected from invalid user zone 172.212.182.128 port 41304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-08 04:50:47 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:53326: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov  8 04:51:11 host2 sshd[4094130]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59371


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 04:51:24 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<2pKOcAlDfrlnPeGp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov  8 04:52:23 host2 sshd[4095511]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 61175


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.212.182.128
country_id: 6252001
description:
Nov  8 04:53:13 host2 sshd[4096282]: Disconnected from invalid user deploy 172.212.182.128 port 49740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 04:53:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<CbbweAlD1Lal6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 04:53:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Az/veAlDmKFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-11-08 04:53:58 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:36148: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 04:53:58 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<haDDeQlDitYBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 04:54:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<pOcffAlDHr5K0NqG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-08 04:54:21 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:33934: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 04:55:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<7XaCfwlDLMSYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  8 04:56:46 host2 sshd[4100473]: Disconnected from invalid user teagan 62.60.131.157 port 20519 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 04:56:29 host2 sshd[4100240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 04:56:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<MBzpgglDCoSxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 04:58:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TFboiQlDLMWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 04:59:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<info@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<NUboiwlD/qUv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.92.189
country_id: 3469034
description:
Nov  8 04:59:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=31.97.92.189, lip=66.85.158.91, session=<ioKejQlDCN4fYVy9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 05:01:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PW+ClAlDnuWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 05:01:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<koqblAlD6MtD2fSf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Nov  8 05:01:44 host2 pure-ftpd[4105043]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 05:03:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<SY6emglDlOMvT+mI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 05:03:21 host2 sshd[4107052]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 05:05:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<pfi1oglDppwz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 05:07:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<WxB8qwlDDGwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 05:07:44 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<UpD5qglDrJpD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 05:07:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<wJENqwlDnqmzALHl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-08 05:08:26 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (staws) [73.13.220.220]:46692: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 05:08:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<ZzH+rglDbIaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 05:09:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Ue0WsQlDSjpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.77.223
country_id: 1643084
description:
Nov  8 05:10:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@euroentertainmentlk.com>, method=PLAIN, rip=72.60.77.223, lip=66.85.158.91, session=<ffL6tAlDSs1IPE3f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 05:11:07 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<kq4NtwlDNpal0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 05:11:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<PtwItwlDofkvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 05:11:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<yhmAuAlD+NJK4fqm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Nov  8 05:12:26 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.40, lip=66.85.158.92, TLS, session=<7W/ouwlDvOzN0h8o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 05:12:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<zovzvAlDuoVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 05:14:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<uEAbwwlDKrei8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 05:18:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FimwzwlDAJJnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 05:17:19 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<H/E9zQlDdOcvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 05:17:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<c5lozQlDQsVm1PbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-11-08 05:21:05 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (poludia) [73.13.220.220]:34654: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 05:22:00 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2W4D3glDTJkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 05:21:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<lXw33AlDhMyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 05:21:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<L78w3QlDjsFm1bVi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-08 05:21:47 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:47477: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 05:21:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<lRoo3QlD9Lov/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 05:21:48 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<qM1K3QlDDqjRJvZG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.241.83.84
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.241.83.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.129.57.97
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.129.57.97 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.31.147
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 69.138.31.147 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.59.81
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 184.164.59.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.10.227.97
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.10.227.97 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.66.149.6
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.66.149.6 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 05:23:14 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<3Odh4glDpMlnoNQc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.18.227.229
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 70.18.227.229 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 05:24:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<+p1F5QlDHu0vT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 05:25:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<1xY56wlD2IQr4TT5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.91
country_id: 6252001
description:
Nov  8 05:26:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0UQg7glDRsHN0h9b>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 05:28:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<FuK98wlDzrUv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 05:28:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<azpF9QlDjBFn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 05:29:40 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<4Wtr+QlDnKac7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 05:30:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<dEmx+glDorxCYSpH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.9
country_id: 6252001
description:
Nov  8 05:31:30 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.9, lip=66.85.158.91, TLS, session=<9icaAApDXvqTuYQJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 05:32:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<v8sDAgpDbJUXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.243.14.52
country_id: 49518
description:
Nov  8 05:32:25 host2 sshd[4141517]: Disconnected from invalid user elearning 197.243.14.52 port 48208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 05:32:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=</yaqAwpD/slm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 05:34:23 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<nU9GCgpDZs6P9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 05:34:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<W64/CwpDmKMrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 05:34:54 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<j3clDApDru2xiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 05:35:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<AZFLDgpDwtTRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 05:37:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<eOgnFgpDLIAzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 05:38:38 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<XO1zGQpD8MVnJFMP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.243.14.52
country_id: 49518
description:
Nov  8 05:38:56 host2 sshd[4149424]: Disconnected from invalid user said 197.243.14.52 port 35926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 05:39:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<sb+bHQpDOpwBFNmn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.243.14.52
country_id: 49518
description:
Nov  8 05:40:32 host2 sshd[4151630]: Disconnected from invalid user hernan 197.243.14.52 port 39916 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 05:40:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<6GxWIQpDR5K2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 05:42:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<3SY3JgpDFo2d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 05:43:47 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Q/LpKwpDqJCUcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 05:45:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<tfbzMApDwqIvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 05:46:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<6M9JNApDZq1nVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.206
country_id: 3469034
description:
Nov  8 05:47:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.44.96.206, lip=66.85.158.91, TLS, session=<037VNQpDAaCxLGDO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 05:47:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<IY+xNwpDvsVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.36
country_id: 798544
description:
Nov  8 05:47:16 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.246.213.36, lip=66.85.158.91, TLS, session=<oVmHNwpDLb9b9tUk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 05:48:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<HUGeOwpDtpZn76Vy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 05:51:12 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<2IFkRgpDFrxK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 05:51:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<q/qqRgpDgMdnPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 05:52:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<FSkQSwpD8uCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 05:52:30 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<cI8LSwpDgOVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 05:53:15 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<t5vFTQpDYrWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 05:53:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<0NZZTwpDtOeYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.182.156.142
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.182.156.142 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 05:56:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<luL2VwpD/JuxiOOT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.81.49.127
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 174.81.49.127 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.184.110
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.242.184.110 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.28.244.134
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.28.244.134 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.14.32
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.97.14.32 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.53.136.208
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.53.136.208 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 05:56:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<zbdhWApDwouPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.6.148.170
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.6.148.170 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 05:57:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<TqZeXQpDgAQv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 05:58:22 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<vzYLYApDiL9D2fSf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.227.103.150
country_id: 2921044
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.227.103.150 - 22-mmc-moh "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 05:59:56 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ISunZQpDQNYz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 06:00:49 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<RtTHaApDTNRFPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 06:04:37 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<uWFpdgpDmbgvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 06:04:39 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<SmKAdgpD5LtD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 06:04:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<HiKAdwpD/pWzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 06:06:02 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<Xf9wewpDGsmP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 06:06:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<37gQfQpDkpUvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 06:06:34 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<zCxafQpDyMYv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 06:08:09 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<lj4MgwpDyRBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 06:09:01 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<eDAqhgpD3slnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 06:12:29 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<fCiMkgpDQNdm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 06:12:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<ip56kQpDWN6l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 06:15:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<GIqvngpDROVK4fqm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov  8 06:16:00 host2 dovecot[3154217]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS: Connection closed, session=<PnE3nwpDkIunXpI1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 06:16:13 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<2/3anwpDkIErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 06:17:17 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<PQW7owpDKrTRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 06:17:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<653KpApDXKIvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 06:17:10 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<UHlLowpDJLw+PIOL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 06:17:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<a+i6pQpD4LVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 06:18:08 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<Of2/pgpDXOUv/WCP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.74
country_id: 6252001
description:
Nov  8 06:18:25 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eMXjpwpDONzG6xhK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 06:19:46 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<yNWPrApDHodnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 06:19:59 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ZOZYrQpDOMpm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 06:20:05 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<nWG6rQpDQvCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 06:23:51 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<06czuwpD3IEv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 06:23:50 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<59kfuwpDSpmc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 06:23:55 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=<7y5muwpDDIYr4TT5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-08 06:24:40 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:41478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-08 06:25:22 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:56076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 06:26:35 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<IFr8xApDlM0BFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 06:26:06 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<fuk3wwpD9KjRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov  8 06:26:11 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<e4+HwwpDLpo+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 06:26:52 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<Dmb3xQpDZpRCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 06:27:53 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<SxyayQpD5tQvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 06:30:33 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<HVwi0wpD/oNm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 06:31:41 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<MGQv1wpDuOaP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 06:32:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<DS3/2gpD1NsrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 06:34:18 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<wW+O4ApDnL+xiOOT>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 06:33:46 host2 sshd[16794]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 06:34:31 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=</5FR4QpD/OhnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 06:35:32 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<stv25ApDhoAzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 06:35:42 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<3fCR5QpDjIwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 06:35:45 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<DvC85QpDWKu2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 06:38:27 host2 dovecot[3154217]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<be5p7wpDNOSd5hjP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 06:40:36 host2 sshd[24498]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 06:40:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<9iw79QpDjKlK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 06:40:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<krjr9QpDMAVn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 06:42:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<DLjo/gpDEr2UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.180.236.143
country_id: 6251999
description:
Nov  8 06:45:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=142.180.236.143, lip=66.85.158.91, session=<fzsPBwtDANOOtOyP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:46:36 host2 sshd[30950]: Disconnected from invalid user jumpserver 162.240.39.179 port 37974 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 06:45:59 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<a+xWCgtDxpFnVK2y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 06:47:06 host2 sshd[31433]: Disconnected from invalid user mohit 45.78.217.139 port 58618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 06:48:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bfOjEgtDXtKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 06:48:32 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<5eF6EwtDNKdn76Vy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.5.98
country_id: 3469034
description:
2025-11-08 06:49:24 dovecot_login authenticator failed for ([45.182.5.96]) [45.182.5.98]:59853: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-08 06:49:53 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57319: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 06:50:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<PNDWGgtD6KUvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 06:51:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JjgLHgtDJpOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 06:51:31 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<nFsdHgtDjtNA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 06:51:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=</MpIHgtD3s9nPeGp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-08 06:51:34 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:41296: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-08 06:51:06 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:53681: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 06:51:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BjRaHQtDfI+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 06:52:39 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<05Y1IgtD9jSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.148.40
country_id: 6252001
description:
Nov  8 06:53:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=162.240.148.40, lip=66.85.158.91, session=<scv6JQtD6MGi8JQo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 06:54:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<hkLdJwtDYqEz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:54:25 host2 sshd[39314]: Disconnected from invalid user nextcloud 162.240.39.179 port 37894 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.233.221.100
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 193.233.221.100 - admin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.228.182
country_id: 2635167
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.242.228.182 - user "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user user (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.172.233
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 166.88.172.233 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: root login is not permitted to cpaneld


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.147.234.25
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.147.234.25 - accounts2@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 06:55:29 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<eQhNLAtDZKNK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 06:55:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<pJ8CKwtDwpBD2fSf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.167.180
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 199.96.167.180 - accounts2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user accounts2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.80.106.50
country_id: 294640
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.80.106.50 - lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech.com (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.253.17.78
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 167.253.17.78 - administrator "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user administrator (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 06:55:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<qSQNLQtDFsuxiOOT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 06:56:16 host2 sshd[41544]: Disconnected from invalid user misha 45.78.217.139 port 60242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:57:07 host2 sshd[42368]: Disconnected from invalid user stephen 162.240.39.179 port 39814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 06:57:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<eww/MgtDKGUv7AMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Nov  8 06:58:26 host2 sshd[43697]: Disconnected from invalid user roger 162.240.39.179 port 40762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-08 06:59:22 dovecot_plain authenticator failed for (essia) [65.20.147.45]:56434: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 06:59:55 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<RQ4vPAtDC3wvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:01:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<cOIZQQtD+MtD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.76.45
country_id: 597427
description:
Nov  8 07:02:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=69.62.76.45, lip=66.85.158.91, session=<xUPORQtDYLRFPkwt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov  8 07:01:57 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<9Xp0QwtDlOo+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:02:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<3LI2RgtD8uiP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 07:04:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<5O10TAtDlOqzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 07:06:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<VRcuUgtDGiwv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.215.134.25
country_id: 3469034
description:
Nov  8 07:06:19 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=181.215.134.25, lip=66.85.158.91, session=<XhMVUwtDZIy114YZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.92.189
country_id: 3469034
description:
Nov  8 07:06:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@euroentertainmentlk.com>, method=PLAIN, rip=31.97.92.189, lip=66.85.158.91, session=<ILfsUwtDdJQfYVy9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 07:07:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<azvvVQtDpzFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 07:08:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<CHs/XAtDLulm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 07:09:05 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<BE3xXAtDrM9noNQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.217.139
country_id: 1880251
description:
Nov  8 07:09:15 host2 sshd[55701]: Disconnected from invalid user labuser 45.78.217.139 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 07:12:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<Ie5jagtDDJnRJvZG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.42
country_id: 3469034
description:
Nov  8 07:13:26 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=177.8.251.42, lip=66.85.158.91, TLS, session=<n6FjawtDTNWxCPsq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:13:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<M0G6bAtDzoovT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 07:13:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<VtEpbQtDGJIBFNmn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 07:14:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<eMjvbgtDDLWl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov  8 07:14:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<3TsvcAtDGqkrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.101
country_id: 1269750
description:
Nov  8 07:13:47 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.101, lip=66.85.158.91, TLS, session=<BabAbAtDTaxnEqZl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 07:16:38 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<YnD3dwtDPMkv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 07:18:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<C5bOfQtDGL9nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 07:18:28 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<i/mAfgtDqOcvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 07:18:50 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<UyzSfwtDZj+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 07:19:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<4F+mggtDQtdm1bVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 07:20:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<V9pjhQtDTuxnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 07:20:34 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<Xz4DhgtDNpGc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 07:19:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@maximsholdings.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<N60xgwtDPuhK4fqm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.144.12
country_id: 3469034
description:
Nov  8 07:19:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=72.60.144.12, lip=66.85.158.91, session=<DreGgwtDMqRIPJAM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 07:20:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<1L6HhAtDOKMv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 07:21:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<b2qhiAtD4t/RJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.52.249
country_id: 290557
description:
Nov  8 07:22:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=43.225.52.249, lip=66.85.158.91, session=</WwmjAtD1uYr4TT5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov  8 07:27:24 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.97.42.71, lip=66.85.158.91, session=<V5NxngtD1rpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:28:04 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<lwDToAtDiJaP9IUv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.19.144.130
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.19.144.130 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov  8 07:30:17 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<k7PdqAtDLvhAPpyi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.106.59.202
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.106.59.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.0.74
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.185.0.74 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 07:30:22 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<ObYTqQtDAtVm1bVi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.169.192
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.59.169.192 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.209.165.92
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.209.165.92 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.12.58
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 172.59.12.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.76.139.239
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.76.139.239 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.162
country_id: 6252001
description:
Nov  8 07:30:51 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.162, lip=66.85.158.92, TLS: Connection closed, session=<ZYDvqgtDcA5APpyi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov  8 07:30:47 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=43.100.60.0, lip=66.85.158.91, session=<fRGQqgtD9OcrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Nov  8 07:32:48 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@euroentertainmentlk.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<iqS/sQtDyoS2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Nov  8 07:32:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@agronatureholdings.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<xYMPsgtDZNFnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov  8 07:33:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<LKYHswtDyOQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  8 07:33:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=51.77.141.29, lip=66.85.158.91, session=<6FgItAtD1oAzTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov  8 07:34:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<VJz0uAtDGqyd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 07:35:09 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<szQsugtD+sGxiOOT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:36:16 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<UkIvvgtDiJYvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.208.218.134
country_id: 6252001
description:
Nov  8 07:37:17 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=74.208.218.134, lip=66.85.158.91, session=<M5DLwQtDxKVK0NqG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.101.55
country_id: 1269750
description:
Nov  8 07:39:26 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.60.101.55, lip=66.85.158.91, session=<0RaEyQtDlOpIPGU3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:40:39 host2 sshd[89287]: Disconnected from invalid user ems 125.22.249.36 port 39218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:42:18 host2 sshd[90867]: Disconnected from invalid user usuario 125.22.249.36 port 53690 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.13.107
country_id: 1269750
description:
Nov  8 07:42:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=148.113.13.107, lip=66.85.158.91, session=<Ztuf1AtDCL+UcQ1r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 07:43:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lezzarotech.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<j0M82AtDgKiPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.22.249.36
country_id: 1269750
description:
Nov  8 07:44:04 host2 sshd[92596]: Disconnected from invalid user beacon 125.22.249.36 port 39936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:45:14 host2 sshd[94367]: Disconnected from invalid user debian 107.175.228.153 port 44330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.253
country_id: 1269750
description:
Nov  8 07:45:37 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@greentaraceylon.com>, method=PLAIN, rip=103.55.105.253, lip=66.85.158.91, TLS, session=<1zOQ3gtDEO1nN2n9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.116
country_id: 953987
description:
Nov  8 07:45:59 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.51.116, lip=66.85.158.91, TLS, session=<67fj3wtDl9lmgTN0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  8 07:46:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<V94d4wtDdKiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.173.178
country_id: 1210997
description:
Nov  8 07:46:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=103.84.173.178, lip=66.85.158.91, session=<DnMr5AtDEtZnVK2y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Nov  8 07:48:40 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<VrOF6gtDU9gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  8 07:49:42 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=103.239.165.114, lip=66.85.158.91, session=<4/o47gtDhLdn76Vy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:50:23 host2 sshd[99676]: Disconnected from invalid user stefanos 107.175.228.153 port 36146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 07:50:47 host2 sshd[99955]: Disconnected from invalid user test3 41.214.125.65 port 47075 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 07:51:21 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<MrUg9AtDOluYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:51:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colourmarklabels.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<+Vl39AtD5oRD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov  8 07:51:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<J5X09AtDfIGl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.228.153
country_id: 6252001
description:
Nov  8 07:51:41 host2 sshd[101016]: Disconnected from invalid user testuser 107.175.228.153 port 40864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  8 07:51:53 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<R3ko9gtDhsZChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  8 07:52:36 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xNyN+AtD2rhA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov  8 07:53:02 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<KmhB+gtDOJ2LonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.61.225.169
country_id: 1269750
description:
Nov  8 07:53:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=103.61.225.169, lip=66.85.158.91, session=<oQ01+gtDQolnPeGp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.211.218.42
country_id: 241170
description:
Nov  8 07:53:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.211.218.42, lip=66.85.158.91, session=<tFNy+gtDBvFn09oq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Nov  8 07:53:54 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zPg+/QtDJT0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.116
country_id: 3469034
description:
Nov  8 07:54:44 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<training@v-deploy.com>, method=PLAIN, rip=191.53.130.116, lip=66.85.158.91, TLS, session=<tbOz/gtDDeK/NYJ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.233
country_id: 953987
description:
Nov  8 07:55:05 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=102.129.50.233, lip=66.85.158.91, TLS, session=<CL13AAxDccpmgTLp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.136.227.147
country_id: 3469034
description:
Nov  8 07:56:35 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=177.136.227.147, lip=66.85.158.91, session=<9brNBgxDiuWxiOOT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.206
country_id: 6252001
description:
Nov  8 07:56:36 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.206, lip=66.85.158.91, session=<cFUGBwxDUOHN0h/O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 07:56:55 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@gemtrails.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<3i4ECAxDBMgv7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.217.244.159
country_id: 6252001
description:
Nov  8 07:57:41 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=67.217.244.159, lip=66.85.158.91, session=<3CbECgxDTLJD2fSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.97.224.210
country_id: 1269750
description:
Nov  8 07:57:52 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=31.97.224.210, lip=66.85.158.91, session=<0M9pCwxDKLIfYeDS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.225.250.166
country_id: 1269750
description:
Nov  8 07:59:30 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colourmarklabels.com>, method=PLAIN, rip=74.225.250.166, lip=66.85.158.91, session=<NiBFEQxDbNJK4fqm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 07:59:33 host2 sshd[109538]: Disconnected from invalid user christine 41.214.125.65 port 38998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov  8 07:59:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=143.244.133.47, lip=66.85.158.91, session=<xE+IEAxDkNyP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Nov  8 07:59:20 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<UqipEAxDqrsvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 1.20.217.167
country_id: 1605651
description:
Nov  8 08:01:03 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=1.20.217.167, lip=66.85.158.91, session=<QsbGFgxDLMQBFNmn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.214.125.65
country_id: 2245662
description:
Nov  8 08:04:11 host2 sshd[114503]: Disconnected from invalid user ubuntu 41.214.125.65 port 40482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.212.246.200
country_id: 192950
description:
Nov  8 08:05:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.212.246.200, lip=66.85.158.91, session=<uMz5JAxDzoxm1PbI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.3.10
country_id: 1880251
description:
Nov  8 08:06:01 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=47.236.3.10, lip=66.85.158.91, session=<v8mLKAxD8o8v7AMK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov  8 08:07:37 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Mz5FLgxDXAVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.177.229
country_id: 3469034
description:
Nov  8 08:06:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=179.0.177.229, lip=66.85.158.91, session=<jleDKwxD/umzALHl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Nov  8 08:09:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@gemtrails.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<tapINAxDEN9noNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.246.70
country_id: 2921044
description:
Nov  8 08:09:27 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=209.38.246.70, lip=66.85.158.91, session=<ZobQNAxDsKPRJvZG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Nov  8 08:09:31 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.244, lip=66.85.158.91, session=<bEk0NQxDe7jDuEz0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Nov  8 08:09:41 host2 dovecot[22732]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.247, lip=66.85.158.91, session=<B4XPNQxDK9/DuEz3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.38
country_id: 6252001
description:
Nov  8 08:09:51 host2 dovecot[22732]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.38, lip=66.85.158.91, session=<K/tgNgxDG8vDuEwm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 08:11:24 host2 sshd[122467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.96.143
country_id: 6252001
description:
Nov  8 08:15:18 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.253.96.143, lip=66.85.158.91, session=<ZwDFSQxDWLMv/WCP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov  8 08:17:07 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=47.251.44.210, lip=66.85.158.91, session=<7ys/UAxDqIYv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 209.38.151.191
country_id: 6252001
description:
Nov  8 08:16:14 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=209.38.151.191, lip=66.85.158.91, session=<g3ocTQxDBJXRJpe/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov  8 08:17:23 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<v/ExUQxDOI+l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 156.238.224.82
country_id: 241170
description:
Nov  8 08:17:43 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=156.238.224.82, lip=66.85.158.91, session=<BUFqUgxDcuOc7uBS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov  8 08:17:51 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<dNfnUgxDyGSYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.213.181.98
country_id: 2215636
description:
Nov  8 08:18:33 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=102.213.181.98, lip=66.85.158.91, session=<RBFkVQxDVoVm1bVi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  8 08:18:15 host2 sshd[131686]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov  8 08:19:49 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<HiPnWQxDJrYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Nov  8 08:20:24 host2 dovecot[22732]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<z8/5WwxDjItnmud6>


