# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.160
country_id: 3469034
description:
Nov 23 08:40:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=177.130.171.160, lip=66.85.158.91, TLS, session=<4c8RYjpE9Nqxgqug>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 08:40:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<zOUyYzpEHssv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.232
country_id: 690791
description:
Nov 23 08:40:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=194.44.78.232, lip=66.85.158.91, TLS, session=<EYk7YzpEEJDCLE7o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 08:40:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<zd7kZDpE7od2wSaf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:41:27 host2 sshd[4186349]: Disconnected from invalid user beck 122.165.121.195 port 38834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 08:42:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<b0ShajpEdKsv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 08:42:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<8AoqazpE9NYv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 23 08:44:26 host2 sshd[4188066]: Disconnected from invalid user user 122.165.121.195 port 56618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-11-23 08:44:50 dovecot_plain authenticator failed for (dinouts) [105.114.21.51]:39438: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 08:45:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<RLv5czpEvImPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 08:46:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<4fyxdzpEBuSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 08:48:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ARN1gTpEHM4+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 08:49:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wSqegjpEMsgv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 08:49:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qtorgzpE8NNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 08:49:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<pESKhDpETpGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 08:51:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<HHFNjDpE0I+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 08:52:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ZNLNjDpEFuQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 08:53:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wkGTkTpEpJwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 08:53:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<eevOkjpEjq8I04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 08:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<LOiOlzpEhq3IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 08:57:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DJsaoTpErucvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 08:58:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<VYEBozpEUukrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 08:58:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<y5xFpTpEpwpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:00:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<jjtkqTpELI5A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:00:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<yw+KrDpE5q8v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 09:01:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Y+kfsDpESJ2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:02:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<htiMsDpEUMV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:03:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<0BsVtDpEGtIv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-23 09:04:38 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (chyrowed) [68.52.119.193]:42764: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-23 09:04:40 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:57748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-23 09:04:52 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:60885: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.109.212.222
country_id: 6252001
description:
2025-11-23 09:04:26 dovecot_login authenticator failed for ([75.109.212.222]) [75.109.212.222]:55334: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:04:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</fdnuTpENsQv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 09:05:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<XzxKvDpEXOs+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:05:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<AMvyuzpEAOkv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:06:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rqIBwTpEZJiPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.210.26
country_id: 6252001
description:
Nov 23 09:08:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.40.210.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<yWMAxjpEgJwUKNIa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:11:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<O3zQ0DpEJLIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:11:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JhhG0TpEItxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 09:13:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fNCA2TpExIel6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:13:41 host2 sshd[15209]: Disconnected from invalid user abdo 186.233.204.9 port 45760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:14:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<IKdp2zpE1qAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 09:14:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<iGKE3DpETI4+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 09:14:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<0BAr3TpE3IanYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-23 09:16:19 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:50662: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 09:16:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<qeRX5DpEhobIMGRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-23 09:16:42 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:51001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 09:16:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<HiPh5TpEmpkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 09:18:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<3WiZ6zpEqK8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 09:18:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<X4gy6zpETg4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 09:19:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<gHUG7zpEsqIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.67
country_id: 953987
description:
Nov 23 09:19:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<training@v-deploy.com>, method=PLAIN, rip=102.64.37.67, lip=66.85.158.91, TLS, session=<xw6+7jpEBapmQCVD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.179.152
country_id: 6252001
description:
Nov 23 09:21:01 host2 sshd[20601]: Disconnected from invalid user seb 172.173.179.152 port 37946 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.122.204
country_id: 690791
description:
Nov 23 09:20:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training>, method=PLAIN, rip=91.228.122.204, lip=66.85.158.91, TLS, session=<yO9s8DpE5o1b5HrM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:21:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<MjAa9zpEJpkv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 09:21:50 host2 sshd[21194]: Disconnected from invalid user admin 2.57.121.112 port 48403 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 09:21:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<QN5M9TpEeBVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 09:22:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<t7lL+TpEHrQ+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<6npC+zpEbtxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:23:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<H/jP+zpEDoov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:23:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A73E/DpEfqd2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:23:59 host2 sshd[22350]: Disconnected from invalid user admin 186.233.204.9 port 50744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 09:24:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<Y0Lv/zpE+rk+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.50
country_id: 226074
description:
Nov 23 09:24:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=196.0.87.50, lip=66.85.158.91, TLS, session=<wrZa/zpEMafEAFcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.134.43
country_id: 3469034
description:
Nov 23 09:24:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=191.53.134.43, lip=66.85.158.91, TLS, session=<numaADtE6uW/NYYr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 09:26:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<oIpsBjtEfog+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 09:26:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<6bGACDtEZLw+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:26:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<G6LMCDtEhLEv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:27:20 host2 sshd[24427]: Disconnected from invalid user deploy 186.233.204.9 port 48672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:28:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<r9QkDztE9NmPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.204.9
country_id: 3469034
description:
Nov 23 09:29:02 host2 sshd[25364]: Disconnected from invalid user ubuntu 186.233.204.9 port 56480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 09:30:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailbox@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<hAkfFTtEXtuSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:30:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<aLa2FTtElLIv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 09:31:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<IUI4GztEpso+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.179.152
country_id: 6252001
description:
Nov 23 09:31:58 host2 sshd[27456]: Disconnected from invalid user sandbox 172.173.179.152 port 45424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 09:31:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Ayu7GDtEbJiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:33:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+E+HHztEApwv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Nov 23 09:33:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dSItIjtEctSG0a02>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:33:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<K8nwHztEQtdn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 09:34:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<U2GyIztEJnCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:34:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<gTp6JTtEYr8EkXBg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-23 09:35:59 dovecot_plain authenticator failed for (culayse) [65.20.129.67]:55782: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 09:37:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<rZwSLztEFOLIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 09:37:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<pjkPMTtEsqPF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 09:39:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<2KbdNDtEbmsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 09:39:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<rGTjNjtEMAanYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 23 09:40:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8QysODtEMrVChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 09:40:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<yGv3OTtEboMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 09:40:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8OkEOztEHMorpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 09:41:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<eT2RPTtECrCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 09:42:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<uZH5QTtEnoEv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 09:43:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WVNvRTtELx1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 09:43:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<9u35RTtEQJU+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.109
country_id: 6252001
description:
Nov 23 09:43:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.109, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Q+lURjtEYMGTuYRt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 09:43:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<bV8SRDtEEosv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 09:43:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<9rh6RDtEdqg+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-23 09:43:26 dovecot_plain authenticator failed for (psonvic) [12.150.243.22]:17501: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 09:44:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<VhWcSTtEjJp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 09:46:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<+LjFTTtEMtJA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:47:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fc0uUjtEoNui2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 09:47:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<7mNtVDtEFo8+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:48:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<IXfDVjtEeOOi2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 09:48:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<O7LXVjtEWLY+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-23 09:48:40 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:42759: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.196.85
country_id: 3175395
description:
2025-11-23 09:48:58 dovecot_login authenticator failed for net-2-40-196-85.cust.vodafonedsl.it [2.40.196.85]:48711: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 09:48:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<xRtoWDtE2J4v+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:49:28 dovecot_login authenticator failed for (Z2l0sN63L) [178.16.54.32]:57346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:50:16 dovecot_login authenticator failed for (if36tdMob) [178.16.54.32]:51568: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 09:50:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<q2N8XTtE0NuPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-23 09:51:25 dovecot_login authenticator failed for (MRcRBU) [178.16.54.32]:50261: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.104.218
country_id: 6252001
description:
Nov 23 09:51:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() syscall failed: Invalid argument (no auth attempts in 0 secs): user=<>, rip=20.169.104.218, lip=66.85.158.91, TLS handshaking: SSL_accept() syscall failed: Invalid argument, session=<0JzMYjtE2ocUqWja>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.34
country_id: 2635167
description:
Nov 23 09:53:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.34, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<fu+7aTtEHYa594ki>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.234
country_id: 2635167
description:
Nov 23 09:53:13 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.234, lip=66.85.158.91, TLS, session=<OrmqZztE54xX7LDq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.31
country_id: 2635167
description:
Nov 23 09:53:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.31, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6XvAZztE9bZX7LAf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.87
country_id: 6252001
description:
Nov 23 09:53:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.87, lip=66.85.158.92, TLS, session=<rN4raDtEkO/G6xhX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.4
country_id: 2635167
description:
Nov 23 09:54:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.4, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<8GDCbTtEV5BX7LAE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 09:55:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+9T+bTtEvoUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 09:54:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<1w7eajtETKRn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.17
country_id: 2635167
description:
Nov 23 09:54:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.17, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<l/fGaztEY5C594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.169
country_id: 6252001
description:
Nov 23 09:54:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.169, lip=66.85.158.92, TLS, session=<a/tJbDtEnOai2JWp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 09:55:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<U+GwbztE3MkEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 09:55:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<VeribztEurwv+3xn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.2
country_id: 2635167
description:
Nov 23 09:56:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7xe3cTtE2cy594kC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 09:55:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<REn7bjtEFmCYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Nov 23 09:55:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<+9W9bztE59BX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.15
country_id: 2635167
description:
Nov 23 09:56:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.15, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<L3i0cztED7NX7LAP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 09:56:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<mUxwdDtE/p8+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.195.68.63
country_id: 3017382
description:
[2025-11-23 09:56:49 +0530] info [cpaneld] 78.195.68.63 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.52
country_id: 3175395
description:
Nov 23 09:57:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.197.9.52, lip=66.85.158.91, TLS, session=<HdyddjtEp+G5xQk0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Nov 23 09:57:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<oyepdztEmblX7LAl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.155.145
country_id: 3469034
description:
[2025-11-23 09:57:15 +0530] info [whostmgrd] 191.5.155.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.40.160.59
country_id: 2017370
description:
[2025-11-23 09:57:24 +0530] info [cpaneld] 31.40.160.59 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.117.197.21
country_id: 2510769
description:
[2025-11-23 09:57:36 +0530] info [cpaneld] 79.117.197.21 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.152.184.145
country_id: 2921044
description:
[2025-11-23 09:57:38 +0530] info [cpaneld] 88.152.184.145 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.27
country_id: 732800
description:
Nov 23 09:57:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.215.27, lip=66.85.158.91, TLS, session=<nI2zdztEaIm5/9cb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.24
country_id: 2635167
description:
Nov 23 09:57:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.24, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<2tqvdTtEE6K594kY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.166.100.115
country_id: 1282988
description:
[2025-11-23 09:57:13 +0530] info [cpaneld] 103.166.100.115 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.254.167
country_id: 6252001
description:
[2025-11-23 09:58:29 +0530] info [cpaneld] 129.222.254.167 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.120.248.202
country_id: 3625428
description:
[2025-11-23 09:58:43 +0530] info [cpaneld] 190.120.248.202 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.237.121.20
country_id: 99237
description:
[2025-11-23 09:58:45 +0530] info [whostmgrd] 212.237.121.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.68.15
country_id: 1282988
description:
[2025-11-23 09:58:57 +0530] info [cpaneld] 27.34.68.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.168.68.240
country_id: 2077456
description:
[2025-11-23 09:59:05 +0530] info [cpaneld] 125.168.68.240 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Nov 23 09:58:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<3nmkeTtELdZX7LAK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 09:58:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<c1+keTtE8KTIMGRT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.254.146.19
country_id: 3469034
description:
[2025-11-23 09:59:08 +0530] info [cpaneld] 170.254.146.19 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 09:59:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<S9eVfjtEstYvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.235
country_id: 6252001
description:
Nov 23 09:59:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=162.216.149.235, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</qX4fjtE7tWi2JXr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 10:00:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<6inagDtE2JCWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.235
country_id: 6252001
description:
Nov 23 10:00:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.235, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<RK1rgjtEROOi2JXr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.219
country_id: 6252001
description:
Nov 23 10:01:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.219, lip=66.85.158.91, session=<lPURhDtEmvHG6xjb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 10:02:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<VPinhztE1IMrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 10:02:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<GhFDiTtEkuY+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 10:03:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<Ld14jDtEyNgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 10:03:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<drmOjDtEJOUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 10:04:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<c2U9jjtEtNsI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.235
country_id: 6252001
description:
Nov 23 10:04:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.235, lip=66.85.158.91, TLS, session=<Jh4+jztEqvai2JXr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 10:05:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<8SThkTtE0JmnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 10:05:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<43BHlDtESLE+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 10:06:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<E0ljlTtEACVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 10:06:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<VzGLljtEHpl2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 10:09:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<JcZ7oDtEYLOl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 10:09:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<TEcioTtEJtxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 10:10:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<oo+LpDtEYLE+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 10:11:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<O+DcpztEPowv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 10:12:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qRDuqztENLiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 10:14:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tBdqtTtEiudn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 10:16:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=</o6yujtESlCYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 10:16:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<jJmzujtEOLcEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 10:17:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZTlfvTtE2N0v+wDY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.95.75
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.95.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.34.68
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 60.50.34.68 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.147.226.158
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.147.226.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.53.32.115
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 60.53.32.115 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.110.74.179
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.110.74.179 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 10:19:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<qVG+wztEHOo+PIOK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.206.115.149
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.206.115.149 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 10:19:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<PSOIxTtEXo7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.14
country_id: 3175395
description:
Nov 23 10:20:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=217.26.179.14, lip=66.85.158.91, TLS, session=<OIpjxztE3a/ZGrMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 10:20:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MyRqyDtE3MMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.15.203
country_id: 3469034
description:
Nov 23 10:20:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.39.15.203, lip=66.85.158.91, TLS, session=<lgmvyDtE/qaxJw/L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 10:20:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<rU9myjtEAusv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-11-23 10:23:05 dovecot_plain authenticator failed for (meniallort) [199.192.123.12]:42304: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 10:23:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8kQ51TtEYKwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 10:23:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<3jcj1TtEsIov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 10:24:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<NIRj1ztEdMEv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.177.255.94
country_id: 130758
description:
2025-11-23 10:24:40 dovecot_plain authenticator failed for (semmus) [195.177.255.94]:46834: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 10:27:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<oxmh4DtEOKQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 10:27:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<3wEV4ztEkMUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 10:27:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<jKQD4ztEspU+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 10:28:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<arAA5DtEapR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 10:28:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Mu0V5jtE4ipniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 10:28:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<vfUg5ztEYuSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 10:29:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<betY6jtE+DOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 10:32:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<0wAf8ztE9INA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 10:33:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=</g5s+DtE5ucv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 10:34:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<IoL1+jtEENqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 10:36:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5mOvADxEjItn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 10:36:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<44qhAzxENJal6LP6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.198.96.155
country_id: 1668284
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 60.198.96.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 10:37:23 host2 sshd[69271]: Disconnected from invalid user odalys 62.60.131.157 port 40420 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.54.127
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.22.54.127 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.87.198.123
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.87.198.123 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 10:37:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<TRVvBzxE2EGYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.233.41.201
country_id: 2963597
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 80.233.41.201 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.55.4.129
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 94.55.4.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Nov 23 10:37:35 host2 sshd[69412]: Disconnected from invalid user sysadmin 45.94.4.230 port 47002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 10:37:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<eD1QBjxEUpcEkXBg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.156.164.72
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.156.164.72 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.74.45.160
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.74.45.160 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Nov 23 10:39:16 host2 sshd[70467]: Disconnected from invalid user alice 45.249.246.88 port 30718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 10:39:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<qtH8DDxEkscv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 10:39:30 host2 sshd[70634]: Disconnected from invalid user admin 2.57.121.112 port 25646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 23 10:39:55 host2 sshd[70882]: Disconnected from invalid user nacos 103.13.206.142 port 42442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 10:41:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<OuuYEjxE8pPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 10:41:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<N40GEzxElvAvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 23 10:41:28 host2 sshd[71958]: Disconnected from invalid user telegram 207.249.96.38 port 56134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Nov 23 10:41:42 host2 sshd[72114]: Disconnected from invalid user dev 45.94.4.230 port 45730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 10:42:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Ouy1FjxEApo+PIcl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.94.4.230
country_id: 298795
description:
Nov 23 10:42:59 host2 sshd[72922]: Disconnected from invalid user ashish 45.94.4.230 port 37508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 23 10:43:28 host2 sshd[73281]: Disconnected from invalid user ftpuser 103.13.206.142 port 41894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 10:43:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=</HepHDxELog+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 10:44:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<ELyuHjxE0p8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 10:45:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<awCxIzxESKov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 10:45:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<f9qZIzxE3JAv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Nov 23 10:45:24 host2 sshd[75199]: Disconnected from invalid user soporte 45.94.4.230 port 38304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 23 10:45:31 host2 sshd[75232]: Disconnected from invalid user ec2-user 103.13.206.142 port 60646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 10:45:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<TKEbIzxEUNUrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Nov 23 10:46:36 host2 sshd[75771]: Disconnected from invalid user ksiegowosc 45.94.4.230 port 58736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Nov 23 10:47:19 host2 sshd[76179]: Disconnected from invalid user ec2-user 45.249.246.88 port 17288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Nov 23 10:47:20 host2 sshd[76200]: Disconnected from invalid user best 70.54.182.130 port 39981 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 23 10:47:25 host2 sshd[76229]: Disconnected from invalid user geoserver 207.249.96.38 port 52380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 10:48:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53634: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 10:49:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<RO3+MTxEILF2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Nov 23 10:49:51 host2 sshd[77563]: Disconnected from invalid user vida 190.119.198.81 port 37602 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 10:50:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<S7S4MjxE2r8+PIcq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 23 10:50:20 host2 sshd[78035]: Disconnected from invalid user test 207.249.96.38 port 57806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 10:50:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<CdVINTxE2DRniu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 10:51:27 host2 sshd[78587]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 10:51:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1gNKODxESrAI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 23 10:51:52 host2 sshd[78778]: Disconnected from invalid user ftpuser 207.249.96.38 port 52138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Nov 23 10:52:12 host2 sshd[79004]: Disconnected from invalid user jeff 45.249.246.88 port 16098 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 10:53:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<LFQKPzxEuOEDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 23 10:53:54 host2 sshd[79909]: Disconnected from invalid user atul 186.233.118.22 port 51050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Nov 23 10:54:12 host2 sshd[80603]: Disconnected from invalid user ftpuser 70.54.182.130 port 59118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 10:54:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<FXH6QjxEFuKnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.246.88
country_id: 1819730
description:
Nov 23 10:54:42 host2 sshd[81111]: Disconnected from invalid user frappe 45.249.246.88 port 15518 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 10:54:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<lXMMRDxE5I0DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 23 10:55:05 host2 sshd[81529]: Disconnected from invalid user testuser 103.13.206.142 port 33636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.76
country_id: 3865483
description:
Nov 23 10:54:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.124.218.76, lip=66.85.158.91, TLS, session=<6i3IQDxEZ9G6fNpM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.210
country_id: 3865483
description:
Nov 23 10:54:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.181.97.210, lip=66.85.158.91, TLS, session=<zKwBQjxEHaG+tWHS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Nov 23 10:54:35 host2 sshd[81063]: Disconnected from invalid user gpadmin 190.119.198.81 port 42090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Nov 23 10:56:03 host2 sshd[82186]: Disconnected from invalid user testftp 190.119.198.81 port 43572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 10:55:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<DScsRTxEBtNA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 10:55:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<H7ptRTxEwrYDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 23 10:55:14 host2 sshd[81663]: Disconnected from invalid user flex 186.233.118.22 port 60216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 10:56:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<cMBFSTxETtUv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 10:56:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<9VKiSTxEHNSPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 23 10:56:31 host2 sshd[82438]: Disconnected from invalid user farmacia 186.233.118.22 port 50068 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 10:56:46 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<cO7vSjxEkooDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 10:57:19 host2 sshd[83050]: Disconnected from invalid user odalys 62.60.131.157 port 60656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 10:57:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CvowTTxEVLln9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Nov 23 10:57:51 host2 sshd[83375]: Disconnected from invalid user pooja 186.233.118.22 port 59504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 10:57:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<rx/8TjxEsseWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 10:58:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<f/+YUjxEtrcEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 10:59:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<9ChzVTxE+jOYIMkL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:00:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<PHpkVzxEWooDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:01:16 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<6gcPWzxELJMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:02:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ll5wXjxEhK8DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 11:02:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<OxnuXjxERNAvTJuG>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:02:25 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<0QAiXzxE4toDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 11:02:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<HPnQXzxEWK/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 11:02:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rKkYXjxEYLEv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Nov 23 11:03:40 host2 sshd[88183]: Disconnected from invalid user ashish 103.13.206.142 port 34140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 23 11:03:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<aj68ZDxEHKNChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.81.230.117
country_id: 3175395
description:
Nov 23 11:03:09 host2 sshd[87710]: Disconnected from invalid user ftpuser 77.81.230.117 port 51406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Nov 23 11:03:11 host2 sshd[87863]: Disconnected from invalid user p 70.54.182.130 port 56389 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:03:32 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<J0MiYzxERO4DjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.81.230.117
country_id: 3175395
description:
Nov 23 11:04:16 host2 sshd[88791]: Disconnected from invalid user k8s 77.81.230.117 port 59982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 11:05:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<n3xEaDxE2oSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 11:05:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<CIaOaTxEjssv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 23 11:05:39 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<bL+8ajxEPt8DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.81.230.117
country_id: 3175395
description:
Nov 23 11:06:33 host2 sshd[90408]: Disconnected from invalid user drew 77.81.230.117 port 46358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 11:07:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<z9sicTxEzI8rpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.81.230.117
country_id: 3175395
description:
Nov 23 11:07:38 host2 sshd[91175]: Disconnected from invalid user cms 77.81.230.117 port 47708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Nov 23 11:07:55 host2 sshd[91383]: Disconnected from invalid user ksiegowosc 70.54.182.130 port 54406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 11:07:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<0uqZcDxEaJMv7PP+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.60.101.156
country_id: 798544
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.60.101.156 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.110.149.135
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.110.149.135 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 11:11:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<9RKnfjxElpUv+3xn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.194.243.142
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.194.243.142 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.167.50.189
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 125.167.50.189 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.176.63.196
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.176.63.196 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.34.98.184
country_id: 1668284
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 1.34.98.184 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 11:11:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<VuU1gDxEjpt2wSaf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.37.186.118
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.37.186.118 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 11:13:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ZaT4hTxEuKU+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 11:15:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<JliMjzxE/siSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 11:15:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<DdEijTxErrY+PIcr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.165.13.69
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.165.13.69 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.190.222.180
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.190.222.180 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.119.57.129
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 112.119.57.129 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.168.225.31
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 14.168.225.31 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 11:15:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<IDXsjTxEMp0I04Sw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.99.74.48
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.99.74.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.41.89.39
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.41.89.39 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.74
country_id: 690791
description:
Nov 23 11:16:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=194.44.140.74, lip=66.85.158.91, TLS, session=<J76tkTxEnaDCLIxK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.12
country_id: 6252001
description:
Nov 23 11:17:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.12, lip=66.85.158.91, session=<jRYDljxEWKAs3LkM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.40
country_id: 690791
description:
Nov 23 11:17:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.221.157.40, lip=66.85.158.91, TLS, session=<0kPFkjxE+9Ql3Z0o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 11:18:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JVxjmDxESI+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 11:18:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DOABmTxEttxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 11:19:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<aeZomjxE6sIv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 11:18:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<xPN3lzxESJlA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 11:19:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<J/LmmzxEhH+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 11:20:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=</O3XnjxEXuYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 11:21:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<QXq8ozxESP2YIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.174.60.39
country_id: 6252001
description:
Nov 23 11:22:10 host2 sshd[102636]: Disconnected from invalid user utente 108.174.60.39 port 60536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 11:23:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<emESqzxEwOQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 11:24:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<qObarDxE0I/IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 11:24:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BpK8rjxEBpwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 11:26:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<fbGYtDxEloov7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-23 11:28:07 dovecot_plain authenticator failed for (benhyst) [173.25.186.130]:51432: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 11:27:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<YuNttzxEzomWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.27
country_id: 6252001
description:
Nov 23 11:27:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.27, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2wK1tzxE0tQSYQUb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.174.60.39
country_id: 6252001
description:
Nov 23 11:27:35 host2 sshd[107348]: Disconnected from invalid user payment 108.174.60.39 port 58224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 11:29:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<d0EsvjxExOov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 11:29:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+3povzxE3rgrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.174.60.39
country_id: 6252001
description:
Nov 23 11:31:00 host2 sshd[110428]: Disconnected from invalid user luciano 108.174.60.39 port 38770 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.235
country_id: 6252001
description:
Nov 23 11:30:10 host2 pure-ftpd[109688]: (?@205.210.31.235) [INFO] New connection from 205.210.31.235


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.150.246.20
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.150.246.20 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.65.224.210
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.65.224.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.154.205
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 92.99.154.205 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.194.26.184
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 168.194.26.184 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.162.194.252
country_id: 6252001
description:
Nov 23 11:33:03 host2 pure-ftpd[112076]: (?@54.162.194.252) [INFO] New connection from 54.162.194.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.48.145.251
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.48.145.251 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 11:33:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<+IC1zTxE4rSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 11:33:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<U7HFzjxEQLh2wSaf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.162.194.252
country_id: 6252001
description:
Nov 23 11:33:10 host2 pure-ftpd[112146]: (?@54.162.194.252) [INFO] New connection from 54.162.194.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.176.210.251
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 92.176.210.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.253.54.114
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.253.54.114 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 11:34:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<im7A0jxE1EVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 11:36:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<BByR2DxEDuM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 11:36:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<WsYL2jxEsMkv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Nov 23 11:37:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<CRII3jxEJKEFhH+s>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 11:38:15 host2 sshd[115933]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 11:39:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<G+C14jxEVooI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 11:39:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qRm45DxEeNZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 11:40:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<6i2a5zxE2Ok+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 11:40:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<5H6n5jxEhsmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 11:41:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<ASzN6jxE/KRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 11:41:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<wncd6zxEisYEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 11:41:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<W51h6zxEULAv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 11:42:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<YFKK7TxEMJI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 11:43:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<mQK88TxEVO+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 11:45:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<qG599zxE3lgvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:44:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<o0Hk9DxEhs8Dg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 11:44:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<chYX9jxEPDWnYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:45:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<I4Pz9zxEluADg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 11:45:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<1gB++TxEPoXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 11:45:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Dm9++jxEipQ+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:47:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2FDX/jxEKOgDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 11:47:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gpbk/zxE2oUv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:47:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vbAcAD1Eoq4Dg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 11:47:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<4Ag+AD1EtNQv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:48:34 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<uK4vBD1EgpYDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 11:49:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<yFn4Bj1Ego4+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:49:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Bat1CD1ExMMDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 11:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<y42fCz1EdtMv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<I7e7Cz1EGukDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:51:15 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<OUfSDT1EwK8Dg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.27.78
country_id: 226074
description:
Nov 23 11:51:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@weeratrading.com>, method=PLAIN, rip=196.0.27.78, lip=66.85.158.91, TLS, session=<Cv+jDD1EgKHEABtO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 11:51:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<q0LrDj1EYt4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.162
country_id: 3469034
description:
Nov 23 11:51:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 31 secs): user=<info>, method=PLAIN, rip=187.120.72.162, lip=66.85.158.91, TLS, session=<aMA6Dj1EyLW7eEii>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:53:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<3VeSFT1ECNIDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-23 11:54:14 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:51117: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:54:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<iReMGD1ETpkDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-23 11:54:49 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:46093: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 11:55:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Q9+wHT1E1KZ2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 23 11:56:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<CHqoIT1E/uoDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 11:56:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<mNIqIj1EFNeWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 11:57:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<qJ5RIj1Eqk1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 23 11:58:22 host2 sshd[130550]: Disconnected from invalid user sysadmin 104.168.103.115 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Nov 23 11:58:32 host2 sshd[130607]: Disconnected from invalid user lee 64.227.135.37 port 35658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 11:58:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<l+kYKD1EPuU+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 11:58:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<CquXKD1EHNE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Nov 23 12:00:29 host2 sshd[132227]: Disconnected from invalid user isaac 103.18.229.251 port 57854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 23 12:00:46 host2 sshd[132425]: Disconnected from invalid user p 104.168.103.115 port 56602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 23 12:01:51 host2 sshd[133111]: Disconnected from invalid user gp 104.168.103.115 port 41764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 12:01:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<URnuMz1EVqSl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 12:01:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<GTpZMT1EALRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 12:01:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<he9pMT1Efro+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.18.229.251
country_id: 1694008
description:
Nov 23 12:01:46 host2 sshd[133044]: Disconnected from invalid user sun 103.18.229.251 port 49302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 12:02:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<kf2SNj1EfLCPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.43.65
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.196.43.65 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.203.164.141
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 112.203.164.141 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.57.38
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 121.121.57.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.217.34.220
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 188.217.34.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.3
country_id: 2264397
description:
Nov 23 12:03:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.209.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<t7/nOT1Eb4xtadED>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 23 12:04:06 host2 sshd[135239]: Disconnected from invalid user es 104.168.103.115 port 35286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.160.143.1
country_id: 1820814
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 119.160.143.1 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.2
country_id: 2264397
description:
Nov 23 12:03:30 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.2, lip=66.85.158.91, session=<0KObOT1EzdFtadEC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.4
country_id: 2264397
description:
Nov 23 12:03:35 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.4, lip=66.85.158.91, TLS, session=<fTHrOT1E/YdtadEE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.4
country_id: 2264397
description:
Nov 23 12:03:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.209.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<YY7pOT1EZ4NtadEE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.238.140.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.238.140.81 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 12:03:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<t0v2OD1EIuQI04Sw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.5
country_id: 2264397
description:
Nov 23 12:03:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.5, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mhjVOT1EzY5tadEF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.2
country_id: 2264397
description:
Nov 23 12:03:35 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=109.105.209.2, lip=66.85.158.91, session=<o+bmOT1E0qhtadEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 12:03:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<z5pEOD1ElOQEkXBg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.233.208
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.167.233.208 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 12:03:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<qlMCOT1EAOUv+3xn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.3
country_id: 2264397
description:
Nov 23 12:03:35 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.3, lip=66.85.158.91, TLS, session=<YProOT1EfZVtadED>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 12:05:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<SjfPPz1EoOGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 12:05:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<rz4HQD1E9tNA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Nov 23 12:05:52 host2 sshd[136740]: Disconnected from invalid user pooja 103.18.229.251 port 49930 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.103.115
country_id: 6252001
description:
Nov 23 12:05:11 host2 sshd[136047]: Disconnected from invalid user lee 104.168.103.115 port 53224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 12:05:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Bk2yPz1E1p0v+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 12:06:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<HqMYRT1EBFIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Nov 23 12:07:16 host2 sshd[137558]: Disconnected from invalid user testserver 64.227.135.37 port 54806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 12:07:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<aZpTSD1EfobIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 12:09:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<iD/VTT1EaNYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 12:10:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<C0/NUD1EfEanYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.135.37
country_id: 1269750
description:
Nov 23 12:11:04 host2 sshd[140192]: Disconnected from invalid user css 64.227.135.37 port 54534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 12:10:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<E7kZVD1EIt4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 12:12:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<zMZHWT1EaLwv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 12:12:45 host2 sshd[141142]: Disconnected from invalid user keyon 62.60.131.157 port 17609 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 12:14:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<QpImXz1EBJkrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.144
country_id: 3175395
description:
Nov 23 12:14:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@saara.lk>, method=PLAIN, rip=185.197.8.144, lip=66.85.158.91, TLS, session=<ZtnrXT1E9ta5xQiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Nov 23 12:14:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=<P2TwXz1EytexV8mH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 12:17:32 host2 sshd[144092]: Disconnected from invalid user admin 2.57.121.112 port 53848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 12:17:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<X29ebD1E9rB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 12:18:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<KuhMcD1ENsM+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 12:19:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<hVLhcj1ETQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 12:20:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<VYGQdj1ESMs+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 12:22:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<xmZ8fj1E8MBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 12:25:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<GcOFhj1ERp4EkXBg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.220.146.49
country_id: 2589581
description:
[2025-11-23 12:24:22 +0530] info [cpaneld] 41.220.146.49 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.76.50.229
country_id: 6252001
description:
[2025-11-23 12:24:24 +0530] info [cpaneld] 173.76.50.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.187.21.20
country_id: 272103
description:
[2025-11-23 12:24:26 +0530] info [cpaneld] 94.187.21.20 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.253.158.46
country_id: 3932488
description:
[2025-11-23 12:24:50 +0530] info [cpaneld] 38.253.158.46 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.218.182
country_id: 1733045
description:
[2025-11-23 12:24:51 +0530] info [cpaneld] 180.74.218.182 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.73.66
country_id: 1282988
description:
[2025-11-23 12:24:57 +0530] info [cpaneld] 27.34.73.66 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 12:25:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nsQbiD1EpomPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 12:25:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<lvZviT1EpKCWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 12:27:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<y+1YkD1E6NAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 12:27:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<KP6RkD1EDI8v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 12:27:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<UjXZkD1EuphA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 12:27:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<q1/Yjj1EUtOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 12:28:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<69DnkT1EBKovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 12:28:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<E1eLkz1EdIsv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 12:29:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pHHclj1Evtel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 12:29:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<KiAklz1EgNXIMGRT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.80.253.71
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.80.253.71 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.176.75.211
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.176.75.211 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.57.246
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.46.57.246 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.25.25.204
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.25.25.204 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.3.68.232
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.3.68.232 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 12:30:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<MIa9mT1EaN8v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 12:30:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<GFNCmj1EAMM+PIcq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.178.12
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 37.65.178.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.164.152
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 14.191.164.152 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 126.76.244.163
country_id: 1861060
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 126.76.244.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.39.57.115
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.39.57.115 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.183.42.78
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.183.42.78 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 12:32:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<C6+UoT1EwIk+PIcg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.225.142.80
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.225.142.80 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.85.250.5
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.85.250.5 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.230.94.28
country_id: 2464461
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.230.94.28 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.207.12.200
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.207.12.200 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 12:33:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qg0goz1ERKWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 12:34:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<bdh6pz1E+qQv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 12:34:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<P9Tdpz1E9Mcv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 12:35:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<rqD9rD1E4rk+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 12:36:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8kZCrz1E5MErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 12:39:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<sGSVuz1E+qN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 12:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<JQABvT1EEt0+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 12:42:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<administrator@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<44uNwz1EThVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 12:44:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<g6ZXzT1EZIpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 12:46:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<9Kn21D1E6IIEkXBg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 12:48:05 host2 sshd[163485]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 12:48:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<wphB2T1EdOc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 12:48:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qF+k2T1Evp6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 12:49:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wTrO3j1EFOMvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.12.197
country_id: 1269750
description:
2025-11-23 12:49:49 dovecot_login authenticator failed for ([103.66.12.197]) [103.66.12.197]:37025: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 12:49:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<kRmx3T1E1OVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 12:49:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<J+WC3j1ENMeYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 12:50:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<nlhU4T1Epqgv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.75.153
country_id: 6252001
description:
Nov 23 12:50:08 host2 sshd[164828]: Disconnected from invalid user ahmed 86.109.75.153 port 53894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-11-23 12:50:22 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:42845: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 12:51:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<YyZy5j1ErLgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 12:52:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<aYAf5z1EpNTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 12:51:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Ij2m5T1EDNQ+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 12:53:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<fIHe6j1E5JuWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 12:52:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<lga05z1EXOcv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 12:52:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<1WRw6D1E+LwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 12:55:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Cps+8z1ESDSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 12:56:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<efHg9j1E9I0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 12:56:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<7Vq99z1Ero+l6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.75.153
country_id: 6252001
description:
Nov 23 12:57:20 host2 sshd[169633]: Disconnected from invalid user nikola 86.109.75.153 port 45010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 12:57:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+PB/+z1E+rEv+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.180.141.49
country_id: 2264397
description:
Nov 23 12:58:22 host2 pure-ftpd[170171]: (?@185.180.141.49) [INFO] New connection from 185.180.141.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.180.141.48
country_id: 2264397
description:
Nov 23 12:58:25 host2 pure-ftpd[170185]: (?@185.180.141.48) [INFO] New connection from 185.180.141.48


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.180.141.47
country_id: 2264397
description:
Nov 23 12:58:27 host2 pure-ftpd[170201]: (?@185.180.141.47) [INFO] New connection from 185.180.141.47


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.146.184.77
country_id: 6252001
description:
Nov 23 12:58:29 host2 sshd[170226]: Invalid user info@idesignvector.com from 23.146.184.77 port 60835


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.109.75.153
country_id: 6252001
description:
Nov 23 13:00:02 host2 sshd[171062]: Disconnected from invalid user tony 86.109.75.153 port 56758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 12:59:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<ytP0AD5EJu4rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-23 12:59:58 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:60532: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-11-23 13:00:39 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:46317: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-11-23 13:01:47 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:36634: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.75.153
country_id: 6252001
description:
Nov 23 13:01:26 host2 sshd[171999]: Disconnected from invalid user farhan 86.109.75.153 port 48304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 13:02:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<fJkqDD5EtN12wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-11-23 13:02:30 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (lusiele) [73.197.236.163]:49074: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 13:03:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<abuse@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<GphBDz5EeMQ+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-11-23 13:03:44 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (scang) [98.203.34.136]:60194: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 13:04:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<b7hpEz5EMq4+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 13:04:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<phaiFD5Eohpniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.207.173
country_id: 6252001
description:
Nov 23 13:05:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=69.164.207.173, lip=66.85.158.92, session=<cu28Fz5ErqNFpM+t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.109.75.153
country_id: 6252001
description:
Nov 23 13:06:57 host2 sshd[176276]: Disconnected from invalid user sftptest 86.109.75.153 port 56924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 13:07:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<UZncHD5EHOln9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 13:07:54 host2 sshd[177027]: Disconnected from invalid user reynaldo 62.60.131.157 port 24545 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.199
country_id: 1880251
description:
Nov 23 13:08:53 host2 sshd[177600]: Disconnected from invalid user odoo 45.78.193.199 port 39260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 13:09:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<ZOoAJT5EBo0EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 13:11:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Xn15Kz5E8NVA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 13:11:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<dqzMKz5EFMCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 13:11:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<a54ZLD5EoCYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 13:12:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<PfJHMD5EVr2YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 13:12:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<cyHiMD5Evtw+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 13:13:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<JjyFMj5EtuAv+3xn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-23 13:13:21 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:52972: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 13:13:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<VcOcMz5EgqIv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.129
country_id: 2963597
description:
Nov 23 13:13:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=37.203.49.129, lip=66.85.158.91, TLS, session=<IqRkMz5Ei5slyzGB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.33
country_id: 3469034
description:
Nov 23 13:13:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.199.33, lip=66.85.158.91, TLS, session=<Cz+CND5E+ZWzvcch>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 13:14:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<gzbZNz5E9sfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.120
country_id: 798544
description:
Nov 23 13:16:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=178.219.101.120, lip=66.85.158.91, TLS, session=<F6X+Oz5Es6Ky22V4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.103
country_id: 3077311
description:
Nov 23 13:15:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=85.163.38.103, lip=66.85.158.91, TLS, session=<jH/vOj5EBb9VoyZn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 13:15:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<w6YvPD5E/tQv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 23 13:15:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<ppy3PD5EloVChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 13:17:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<vy2vQD5E1L0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 13:17:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Yh2jQD5EiKgI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 13:17:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<PP/iQD5EvJg+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 13:17:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<nXqoQT5EPsOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 13:17:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<PBY8Qz5EyrjF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 13:18:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8RwdRz5E5uQv7PP+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 23 13:19:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<A4mcSj5ELm5BMQGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 13:20:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Bl8USz5E/rM+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 23 13:20:15 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, session=<dG8VTD5EgLVBMQGY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 13:20:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<v2r6TT5EnLqWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 13:21:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5E8aTz5E2psv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 13:22:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<3ugMUz5EfKwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 13:25:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<Vs4SXT5Exr92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 13:24:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<PRT5WT5EMoel6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.14.96.62
country_id: 2510769
description:
Nov 23 13:26:48 host2 sshd[188990]: Disconnected from invalid user nps 62.14.96.62 port 24490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 13:27:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Sy+0ZT5ErSRniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Nov 23 13:28:12 host2 sshd[189866]: Disconnected from invalid user janusz 213.222.164.230 port 38560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 13:28:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pblsaj5ECIZn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.222.164.230
country_id: 719819
description:
Nov 23 13:29:02 host2 sshd[190249]: Disconnected from invalid user amin 213.222.164.230 port 51478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Nov 23 13:29:52 host2 sshd[190742]: Disconnected from invalid user administrator 213.222.164.230 port 36212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Nov 23 13:30:10 host2 sshd[191051]: Disconnected from invalid user juan 152.32.129.236 port 49626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 13:31:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Wh2Tcz5EdL8EkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Nov 23 13:31:30 host2 sshd[191816]: Disconnected from invalid user rramirez 213.222.164.230 port 55592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 13:32:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<O5fGeD5EyJBA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.14.96.62
country_id: 2510769
description:
Nov 23 13:32:52 host2 sshd[192710]: Disconnected from invalid user p 62.14.96.62 port 60242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Nov 23 13:33:31 host2 sshd[193075]: Disconnected from invalid user grid 152.32.129.236 port 50750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 13:33:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<QpUrej5ETMo+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 13:33:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6uFnej5ELAgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Nov 23 13:33:21 host2 sshd[193000]: Disconnected from invalid user ec2-user 152.42.203.0 port 45802 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 13:34:51 host2 sshd[193740]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov 23 13:34:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<i0I9fj5ESlynXpI6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 13:34:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<xUU0fj5EjNSPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 13:34:36 host2 sshd[193604]: Disconnected from invalid user admin 2.57.121.112 port 29432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Nov 23 13:34:46 host2 sshd[193689]: Disconnected from invalid user git 152.42.203.0 port 36622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 13:34:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<xEmLgD5EfrKYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 13:35:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<GVyGgT5Eosov7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.14.96.62
country_id: 2510769
description:
Nov 23 13:35:21 host2 sshd[194223]: Disconnected from invalid user ftpuser 62.14.96.62 port 54996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 13:35:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<1wpegj5E/Jcv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 13:36:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<H51/hz5EMJbIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 13:39:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<smmwjz5EGPWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 13:39:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<9YqTkD5ElsIv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.104
country_id: 6252001
description:
Nov 23 13:39:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.104, lip=66.85.158.92, session=<xEaakT5EOujN0h9o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 13:41:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<xdFzmT5EOJMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 13:41:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O9u6lj5EgM0v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Nov 23 13:41:13 host2 sshd[197817]: Disconnected from invalid user ftpuser 152.32.129.236 port 60760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Nov 23 13:42:22 host2 sshd[198449]: Disconnected from invalid user git 152.32.129.236 port 38028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-23 13:43:31 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:37566: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.191.47
country_id: 1819730
description:
Nov 23 13:44:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=152.32.191.47, lip=66.85.158.91, session=<iZI7oT5EQJuYIL8v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-23 13:43:15 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:58965: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.27
country_id: 1819730
description:
Nov 23 13:43:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=45.142.154.27, lip=66.85.158.92, session=<Tnfynj5ENsUtjpob>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 13:44:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<41BJoj5EzoQ+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.46.181
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.75.46.181 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.113.21.149
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.113.21.149 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 13:44:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ZPfioz5EpoUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 13:44:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<qqAPpD5ERtgrpAFm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.75.220.130
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.75.220.130 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.227.88
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.36.227.88 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.230.92.49
country_id: 1512440
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.230.92.49 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.217.85.179
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 124.217.85.179 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.74.219.156
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.74.219.156 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 13:47:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<GQN/rT5EUKR2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 13:48:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<oomWsT5E0qaWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.5
country_id: 2635167
description:
Nov 23 13:50:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+Ui4uD5EhalX7LAF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 13:50:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<zQY3tz5EnJg+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 13:50:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<DY9Wtz5E9S5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 13:50:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+xIRuD5Exr1n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.76
country_id: 2635167
description:
Nov 23 13:50:36 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS, session=<ewqcuD5EG4u594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.10
country_id: 2635167
description:
Nov 23 13:51:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.10, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0ZKzuj5Ec9tX7LAK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 13:51:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<xHV6uz5Eouyl6LP6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.21
country_id: 2635167
description:
Nov 23 13:51:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.21, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<M+GuvD5Ev7e594kV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.36
country_id: 2635167
description:
Nov 23 13:52:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aC6qvj5EB5NX7LAk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.8
country_id: 2635167
description:
Nov 23 13:52:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.8, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tZClwD5El8C594kI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 13:53:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<fERtwj5EDuQEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.18
country_id: 2635167
description:
Nov 23 13:53:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.18, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<E/6ewj5EzYG594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.23
country_id: 2635167
description:
Nov 23 13:53:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.23, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GDScxD5EC8BX7LAX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 13:54:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<jD8exT5EXL0+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 13:54:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<hdIayD5EfNovTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.36
country_id: 2635167
description:
Nov 23 13:55:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.36, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<aASRyD5EW8a594kk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 13:54:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<f8BOxT5ETMk+PIOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.11
country_id: 2635167
description:
Nov 23 13:54:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.11, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<iZKXxj5Ec4e594kL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 13:54:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<uEJJxz5EFNFA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.34
country_id: 2635167
description:
Nov 23 13:55:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<t3mMyj5E746594ki>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 13:56:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<QXwFzT5EKNA+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 13:56:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<7gZPzj5EZqMv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.199
country_id: 1880251
description:
Nov 23 13:57:06 host2 sshd[208827]: Disconnected from invalid user ubuntu 45.78.193.199 port 44594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 13:57:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<xgNP0T5EoKaYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 13:57:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<9RTH0T5E7sqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 13:58:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<BbEJ1D5E2IUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 13:59:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ianD1z5EPq7IMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 14:01:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<9Uz94D5E5oCnYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.184
country_id: 2635167
description:
Nov 23 14:01:13 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.184, lip=66.85.158.92, TLS, session=<gJWf3j5EpcdX7LC4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 14:02:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<vRPP5D5EqOQ+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 14:03:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<QIOF5z5E6rUv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 14:03:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<q8zo5T5ENLAv+yXY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 14:03:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wHqO5j5EMqA+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 14:06:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<M6D/8j5EuoAI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-23 14:07:11 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:51509: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
country_id: 2661886
description:
2025-11-23 14:07:27 dovecot_login authenticator failed for 95.209.141.145.bredband.tre.se [95.209.141.145]:46058: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 14:07:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<jkel9j5EmpUrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 14:08:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<LZKO+D5ETKs+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 14:08:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<6ast+j5Emt4v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-23 14:10:44 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:48589: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 14:10:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<hxzDAD9Eiqh2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-11-23 14:11:06 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:39820: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.243.7.4
country_id: 2635167
description:
2025-11-23 14:12:06 dovecot_login authenticator failed for host-89-243-7-4.as13285.net [89.243.7.4]:59104: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.54.191
country_id: 2077456
description:
2025-11-23 14:11:22 dovecot_login authenticator failed for (202-53-54-191.tpgi.com.au) [202.53.54.191]:57864: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-23 14:11:34 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:35010: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.98.168
country_id: 3996063
description:
Nov 23 14:13:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=138.122.98.168, lip=66.85.158.91, TLS, session=<OshXCD9EsOeKemKo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 14:13:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GkiHCT9E1Ddniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 14:13:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@agronatureholdings.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Q+Y9Cj9Ejt8+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.82
country_id: 690791
description:
Nov 23 14:13:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.2.82, lip=66.85.158.91, TLS, session=<FC9wCT9EcYmwZwJS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Nov 23 14:14:12 host2 sshd[220549]: Disconnected from invalid user vpnuser 68.183.46.135 port 48334 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 14:15:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<awADEz9ErKIEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.49
country_id: 1643084
description:
Nov 23 14:16:04 host2 sshd[221777]: Disconnected from invalid user saeed 103.67.78.49 port 36564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-23 14:16:11 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (matraity) [73.224.171.101]:42356: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 14:16:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<r3IwFj9EZDQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 14:16:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<yr1vFj9EnryWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 14:17:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<TiY0Fz9EpoJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 14:17:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<F3d5Fz9EgNw+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 14:18:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<7Af7Gz9EBsUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 14:19:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<tuhSHj9EqOml6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 23 14:19:56 host2 sshd[224491]: Disconnected from invalid user ec2-user 69.49.246.176 port 50696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 14:20:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<SAF9Ij9EnJuYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 14:22:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<bI3UKD9EXJPIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 14:21:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<DqbBJT9ElNWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 14:21:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<dZM3Jj9EBJov+3xn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.49
country_id: 1643084
description:
Nov 23 14:21:42 host2 sshd[225725]: Disconnected from invalid user ec2-user 103.67.78.49 port 33720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 23 14:22:10 host2 sshd[225981]: Disconnected from invalid user vpnuser 69.49.246.176 port 46470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 14:22:39 host2 sshd[226235]: Disconnected from invalid user aria 62.60.131.157 port 30854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 23 14:23:20 host2 sshd[226611]: Disconnected from invalid user hik 69.49.246.176 port 35046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 14:24:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58437: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Nov 23 14:24:28 host2 sshd[227522]: Disconnected from invalid user ftpuser 69.49.246.176 port 39802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 14:24:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=</eLvMT9EhGenYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.49
country_id: 1643084
description:
Nov 23 14:25:56 host2 sshd[228836]: Disconnected from invalid user admin2 103.67.78.49 port 37788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 14:26:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<XDKFOD9Ehp4v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 14:27:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<Wu1kOz9E9p0v+yXY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 14:28:55 host2 sshd[230680]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.107.168
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.134.107.168 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.223.253.115
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.223.253.115 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.148.18.60
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.148.18.60 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.156.180
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.62.156.180 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.210.73.110
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.210.73.110 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.149.98.92
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.149.98.92 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Nov 23 14:28:37 host2 sshd[230367]: Disconnected from invalid user choi 136.232.11.10 port 63564 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.10.141.16
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.10.141.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 14:29:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<7QBXQz9ERJ2SOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.146
country_id: 1880251
description:
Nov 23 14:30:22 host2 sshd[231672]: Disconnected from invalid user arvind 45.78.220.146 port 38422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 14:30:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<flXGSD9EhOXF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 14:31:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<2u5uST9E2MIrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 14:31:20 host2 sshd[232309]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 14:32:24 host2 sshd[232919]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 14:32:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<IqFcTT9EWNwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 14:33:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<hRBHUD9E6sgv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.0.104
country_id: 1814991
description:
Nov 23 14:33:19 host2 sshd[233397]: Disconnected from invalid user support 8.154.0.104 port 48856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 14:33:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<2CUGUj9EzOJ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 14:34:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5AWpVD9EpOZn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.0.104
country_id: 1814991
description:
Nov 23 14:34:17 host2 sshd[233995]: Disconnected from invalid user ftpuser 8.154.0.104 port 39216 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Nov 23 14:35:41 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.91, TLS, session=<UKziWT9EIsRHBobr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 14:36:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VZWEWz9Eq0Bniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.232.11.10
country_id: 1269750
description:
Nov 23 14:36:24 host2 sshd[235291]: Disconnected from invalid user ec2-user 136.232.11.10 port 41907 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.128.43.14
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.128.43.14 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Nov 23 14:38:22 host2 sshd[236455]: Disconnected from invalid user admin2 136.232.11.10 port 23455 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 14:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<S4IjZT9EMLEvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.142.86
country_id: 2921044
description:
Nov 23 14:39:03 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=139.59.142.86, lip=66.85.158.91, TLS, session=<szbiZT9E8pKLO45W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 14:38:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<m/OlYj9ETsMEkXBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.142.86
country_id: 2921044
description:
Nov 23 14:39:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=139.59.142.86, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<qD4nZj9EOJOLO45W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 14:39:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Y5xEaD9ELtJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 14:40:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<QEclaj9E8Kov7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 14:42:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<oKQGcz9EdpCYIMkL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 14:44:17 host2 sshd[240384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 14:45:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<10A0ez9EAo2WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 14:45:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<x8lCez9EqpaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 14:44:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Ba3leT9E6JE+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 14:44:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<njgqej9Eppov+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Nov 23 14:44:15 host2 sshd[240326]: Disconnected from invalid user ftpuser 136.232.11.10 port 48653 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 14:44:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<cq+keT9E6rfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 14:45:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<n0Lrez9Efow+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-11-23 14:46:39 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (ethers) [73.171.230.200]:45952: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 14:46:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Qj8wgT9EkrWl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 14:47:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lf4ChD9EWuanYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.146
country_id: 1880251
description:
Nov 23 14:47:33 host2 sshd[242726]: Disconnected from invalid user airflow 45.78.220.146 port 34972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.2
country_id: 933860
description:
Nov 23 14:47:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.216.209.2, lip=66.85.158.91, TLS, session=<8iyvgz9EltIp2NEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.62.242
country_id: 2510769
description:
Nov 23 14:47:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@weeratrading.com>, method=PLAIN, rip=178.156.62.242, lip=66.85.158.91, TLS, session=<pjKNgj9EWbmynD7y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 14:48:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<IrLphz9E2ocv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.193.79
country_id: 1880251
description:
Nov 23 14:48:40 host2 sshd[243278]: Disconnected from invalid user administrator 45.78.193.79 port 45298 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.252.133
country_id: 1819730
description:
Nov 23 14:49:33 host2 pure-ftpd[243911]: (?@152.32.252.133) [INFO] New connection from 152.32.252.133


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 14:49:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0ashjD9ELqg+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.193.79
country_id: 1880251
description:
Nov 23 14:51:06 host2 sshd[244954]: Disconnected from invalid user like 45.78.193.79 port 56554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-23 14:51:12 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3392: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 14:51:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<ezwAkj9EsIsv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 14:53:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<fOfOmT9EQu4rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 14:55:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<mRaboT9E0qN2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 14:55:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<4D4Coj9EbMA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 14:55:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jVo+oj9EQqBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 14:57:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<ZQ/aqD9E0MkI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 14:57:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<u3N8qT9E5OM+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 14:57:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q7yBpz9E0rIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 14:57:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<67eXpz9EaOQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 14:58:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<JLM5rD9Eesk+PIOJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov 23 14:58:54 host2 sshd[250493]: Disconnected from invalid user ec2-user 103.114.147.217 port 60040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 14:59:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<DOiqrj9Eo0lniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 14:59:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<orursD9E8NoEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 15:00:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9Fecsj9EHNIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 15:01:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ag+dtj9E9NY+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 23 15:01:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<NTGstj9ETrdChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 23 15:02:09 host2 sshd[252609]: Disconnected from invalid user ftpuser 103.154.77.48 port 60994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 15:02:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<cw39uD9ErqAv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 15:02:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<rzARuz9EvM1A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 15:05:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@euroentertainmentlk.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<vKU1wz9EFJU+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 15:05:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<lhU1wz9E5ISYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 23 15:06:17 host2 sshd[255690]: Disconnected from invalid user ansible 103.154.77.48 port 33948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 15:07:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<yPPAyT9EfpfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 15:08:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<2nod0D9ESIwv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 15:09:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<QB5b0T9EdpqPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.236
country_id: 6252001
description:
Nov 23 15:09:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<L8XW0j9EYsbG6xjs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 23 15:10:17 host2 sshd[258323]: Disconnected from invalid user oper 103.154.77.48 port 35118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 15:10:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<O34h1z9Ert8v7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov 23 15:11:18 host2 sshd[258990]: Disconnected from invalid user operation 103.114.147.217 port 49180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 23 15:11:38 host2 sshd[259124]: Disconnected from invalid user bk 103.154.77.48 port 35522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 23 15:13:05 host2 sshd[260013]: Disconnected from invalid user smile 103.154.77.48 port 35932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.98
country_id: 3469034
description:
Nov 23 15:12:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=200.196.143.98, lip=66.85.158.91, TLS, session=<Rs563D9EQczIxI9i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.102
country_id: 798544
description:
Nov 23 15:12:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.240.44.102, lip=66.85.158.91, TLS, session=<03+c3T9EgdFb8Cxm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Nov 23 15:12:52 host2 sshd[259791]: Disconnected from invalid user p 103.114.147.217 port 39634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 15:13:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xiQi4D9EpOmWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-23 15:13:36 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:40596: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 15:14:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<vKch5D9EvOml6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 15:15:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<IOBj5z9EvJI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 15:15:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<6s1W6T9Ewucv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 15:16:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<8Pgl6j9ESqsrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 15:17:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Ov6w7T9EnLU+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Nov 23 15:16:15 host2 sshd[261995]: Disconnected from invalid user sam 103.114.147.217 port 50834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 15:17:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<C7v77z9EoNNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 15:17:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<LU/98D9EsrF2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 15:20:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<IcH++j9EvkinYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 15:21:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<sCqv/j9EMuwEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 15:22:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<2LFn/z9EYIg+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 15:22:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Vk78/z9E2Jwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 15:22:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NtedAUBEru0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 15:22:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<7Ht9AkBExwdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 15:23:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<9YAzBUBEtLcI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 15:24:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<rdvGCEBEHMkv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.148.82
country_id: 1835841
description:
Nov 23 15:24:59 host2 sshd[267220]: Disconnected from invalid user user62 43.128.148.82 port 47918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 23 15:24:35 host2 sshd[267045]: Disconnected from invalid user user 2.57.121.25 port 33636 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.248.42
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 86.97.248.42 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-23 15:25:57 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (nabed) [73.224.171.101]:47744: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.214.16.105
country_id: 192950
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.214.16.105 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.127.132.189
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.127.132.189 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.52.220.108
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.52.220.108 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 15:26:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<r6y+D0BE3OxA44h6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.148.82
country_id: 1835841
description:
Nov 23 15:26:36 host2 sshd[268470]: Disconnected from invalid user ftpuser 43.128.148.82 port 50108 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.251.180.245
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 180.251.180.245 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 15:27:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<VI0DE0BEbJE+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-11-23 15:27:36 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (scripid) [24.23.125.83]:59284: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 15:27:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<aDjNFEBEMHuYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 15:29:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<DOO+GUBErNPIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.148.82
country_id: 1835841
description:
Nov 23 15:29:41 host2 sshd[270575]: Disconnected from invalid user jimmy 43.128.148.82 port 54474 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 15:30:53 host2 sshd[271643]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.228.177.173
country_id: 2029969
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 150.228.177.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.40.160.253
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.40.160.253 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.169.204.109
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.169.204.109 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-11-23 15:30:35 dovecot_plain authenticator failed for (dertia) [88.149.153.106]:40986: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.142.170.210
country_id: 3190538
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.142.170.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.126.188.72
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.126.188.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 23 15:30:40 host2 sshd[271531]: Disconnected from invalid user git 38.47.92.86 port 45052 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.59.249
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.38.59.249 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-11-23 15:31:45 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:54766: 535 Incorrect authentication data (set_id=monnierbenoitmichel@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-23 15:32:23 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:41273: 535 Incorrect authentication data (set_id=monnierbenoitmichel)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.148.82
country_id: 1835841
description:
Nov 23 15:32:46 host2 sshd[272828]: Disconnected from invalid user d 43.128.148.82 port 58836 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 15:33:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<j8QuJ0BEvMgv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 15:33:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<q5NOKEBEIL0v+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 15:33:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<XeuzKUBElNSPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.145.73.86
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.145.73.86 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.90.242.145
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.90.242.145 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.196.97.44
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.196.97.44 - colourmarklabel "GET /login/?login_only=1&user=colourmarklabel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.57.126.167
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.57.126.167 - colourmarkla "GET /login/?login_only=1&user=colourmarkla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.230.122.24
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.230.122.24 - colourmarklab "GET /login/?login_only=1&user=colourmarklab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.152.153.43
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.152.153.43 - colourmark "GET /login/?login_only=1&user=colourmark&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmark (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.222.237.179
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.222.237.179 - colourm1 "GET /login/?login_only=1&user=colourm1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.148.74.113
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.148.74.113 - colourm "GET /login/?login_only=1&user=colourm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.60
country_id: 798544
description:
Nov 23 15:35:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=91.228.33.60, lip=66.85.158.91, TLS, session=<12u9LkBEibRb5CE8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.156.248
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.229.156.248 - colour "GET /login/?login_only=1&user=colour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.159.148.79
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 110.159.148.79 - co "GET /login/?login_only=1&user=co&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user co (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.164.61.231
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.164.61.231 - colo "GET /login/?login_only=1&user=colo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.143.58.16
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 175.143.58.16 - colourm2 "GET /login/?login_only=1&user=colourm2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourm2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.227.214
country_id: 3469034
description:
Nov 23 15:35:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=168.0.227.214, lip=66.85.158.91, TLS, session=<zpfZL0BEIu6oAOPW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.192.137.80
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.192.137.80 - colourmarklabels "GET /login/?login_only=1&user=colourmarklabels&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.78.167.195
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.78.167.195 - colourmarkl "GET /login/?login_only=1&user=colourmarkl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarkl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.109.74.148
country_id: 174982
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.109.74.148 - colourma "GET /login/?login_only=1&user=colourma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.234.182.185
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.234.182.185 - colou "GET /login/?login_only=1&user=colou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.19.103
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.190.19.103 - col "GET /login/?login_only=1&user=col&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user col (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.26.2.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.26.2.45 - colourmarklabelscom "GET /login/?login_only=1&user=colourmarklabelscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabelscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.197.115
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 187.190.197.115 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.98.235.62
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.98.235.62 - colourmarklabe "GET /login/?login_only=1&user=colourmarklabe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmarklabe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.202.248.13
country_id: 1835841
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 122.202.248.13 - colourmar "GET /login/?login_only=1&user=colourmar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colourmar (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 15:36:46 host2 sshd[275670]: Disconnected from invalid user daija 62.60.131.157 port 10766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 15:38:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<LlCxO0BEctcrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 15:39:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7msxPUBEbKRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 15:39:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<DLJrPUBEKrk+PIOJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 23 15:39:48 host2 sshd[277834]: Disconnected from invalid user ftpuser 38.47.92.86 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 15:40:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<jLUpQkBE0Lt2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-23 15:41:02 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:53188: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 15:41:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<3H6/Q0BEutUv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-11-23 15:40:13 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:53276: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 15:41:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<l/5ZREBEbIOWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 15:42:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<GcqDR0BE5uU+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 15:42:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<uVrNR0BE0Iel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 15:42:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<OJdXSEBEWMw+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 15:44:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<9muvTkBEKLUEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 23 15:44:13 host2 sshd[280798]: Disconnected from invalid user user7 38.47.92.86 port 45136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 15:44:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<y603T0BEQJHF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 15:44:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<0XkyT0BEdKo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 15:45:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<8AMyUkBE+rAvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Nov 23 15:45:51 host2 sshd[282255]: Disconnected from invalid user tst 103.210.21.178 port 55786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 15:46:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<teCAVUBEnRFniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 15:46:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Z0CcVUBE1lGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 15:46:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<xQDhVUBEQuM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 15:47:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<3icyW0BE7IYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 15:47:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kQh5WUBE9u0v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 15:50:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<2jWbY0BEKKUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 15:50:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<qtbNZEBEcNdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 15:51:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<4zroaEBEIHOYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 15:51:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@gemtrails.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<vVNuakBEeN0+PIOK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Nov 23 15:52:11 host2 sshd[286147]: Disconnected from invalid user albert 103.210.21.178 port 36172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 15:52:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<W0oNbEBEJtHIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 23 15:53:55 host2 sshd[287123]: Disconnected from invalid user readonly 104.244.74.84 port 43832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Nov 23 15:55:55 host2 sshd[289081]: Disconnected from invalid user ying 103.210.21.178 port 59138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 23 15:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<SgDkeEBEkqSSOC+J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 23 15:55:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<YKvrdkBEzs4+PIOI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Nov 23 15:55:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<tQj2dkBEKIQ+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Nov 23 15:56:37 host2 sshd[289548]: Disconnected from invalid user tst 201.48.78.29 port 48702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Nov 23 15:57:06 host2 sshd[289857]: Disconnected from invalid user p 103.210.21.178 port 50420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 15:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<vFmdeUBEwLEv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 23 15:58:00 host2 sshd[290507]: Disconnected from invalid user frappe 46.24.47.94 port 52750 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 15:57:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<xwqkf0BEeLEv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 15:59:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<usLfg0BEjtWPbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Nov 23 15:59:54 host2 sshd[291708]: Disconnected from invalid user ying 201.48.78.29 port 53110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.210
country_id: 1269750
description:
Nov 23 16:00:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.84.202.210, lip=66.85.158.91, TLS, session=<dvPmiEBE+6VnVMrS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 16:01:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CMv+ikBEVuRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.189
country_id: 3469034
description:
Nov 23 16:01:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.136.189, lip=66.85.158.91, TLS, session=<Goc+ikBEvtC+WYi9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 16:01:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<lbnFjUBEsJUrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 23 16:01:16 host2 sshd[292707]: Disconnected from invalid user sg 104.244.74.84 port 56556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Nov 23 16:01:36 host2 sshd[293005]: Disconnected from invalid user ec2-user 201.48.78.29 port 55304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 23 16:01:45 host2 sshd[293078]: Disconnected from invalid user django 46.24.47.94 port 55064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 23 16:02:58 host2 sshd[293699]: Disconnected from invalid user developer 46.24.47.94 port 57556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 23 16:02:45 host2 sshd[293619]: Disconnected from invalid user sonaruser 107.174.50.169 port 39426 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Nov 23 16:03:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@bostonlanka.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<5HI3k0BExoI+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 16:03:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<oaEQlEBEmq92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 16:03:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<OdB4lEBEzIg+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 23 16:05:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<y5p9mUBEUsI+PIOL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.24.47.94
country_id: 2510769
description:
Nov 23 16:04:14 host2 sshd[295179]: Disconnected from invalid user arash 46.24.47.94 port 60040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 16:04:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Ye1vmEBEAqY+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Nov 23 16:06:31 host2 sshd[296466]: Disconnected from invalid user pujie 202.79.29.108 port 53214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Nov 23 16:07:03 host2 sshd[296781]: Disconnected from invalid user ftpuser 104.244.74.84 port 38526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 16:06:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<LRPDnUBEepU+PIOK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 23 16:06:22 host2 sshd[296423]: Disconnected from invalid user etluser 107.174.50.169 port 58222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Nov 23 16:06:46 host2 sshd[296634]: Disconnected from invalid user teacher 219.92.8.45 port 45030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 16:06:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<6EWkn0BEwMMv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 16:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<f297nUBEYLkEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 16:07:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<x+jPo0BE1BsvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 23 16:07:17 host2 sshd[296896]: Disconnected from invalid user admin 2.57.121.112 port 56877 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 23 16:07:29 host2 sshd[297021]: Disconnected from invalid user ld 107.174.50.169 port 58840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 23 16:08:39 host2 sshd[297689]: Disconnected from invalid user ftpuser 103.243.27.122 port 36868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 16:09:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<prrhqUBEHgWnYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 23 16:09:44 host2 sshd[298599]: Disconnected from invalid user flash 107.174.50.169 port 56302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 16:09:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wf8qqEBExxlniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Nov 23 16:09:20 host2 sshd[298276]: Disconnected from invalid user esbuser 219.92.8.45 port 50934 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 16:09:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<E12KqUBEjI2WXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Nov 23 16:10:39 host2 sshd[299245]: Disconnected from invalid user ftpuser 219.92.8.45 port 40020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Nov 23 16:10:47 host2 sshd[299343]: Disconnected from invalid user ftpuser 202.79.29.108 port 53634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Nov 23 16:11:06 host2 sshd[299531]: Disconnected from invalid user p 103.243.27.122 port 36384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 16:10:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<RMOaq0BE7LEv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 16:10:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<sBEIrUBEJuKl6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.92.8.45
country_id: 1733045
description:
Nov 23 16:11:57 host2 sshd[299951]: Disconnected from invalid user marian 219.92.8.45 port 43772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 16:13:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<YMk5t0BExOk+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 23 16:13:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<1yunt0BETg/Y2s5D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 16:13:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<dxVOuEBEWKdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 16:13:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<PwHptkBEEOAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 16:14:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<y+VzukBE/GiYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Nov 23 16:14:30 host2 sshd[301987]: Disconnected from invalid user mantis 219.92.8.45 port 34166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 16:14:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<bC1KvEBETLXIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 16:16:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<XqLLwkBEdpEI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Nov 23 16:16:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<HQDMwkBEmqs+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 16:18:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</HjEyUBEapov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-23 16:19:01 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:60399: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 16:19:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<1atzzEBEWsc+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 16:21:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<el661UBE7Isv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 16:22:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SfgR2EBEPOFn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 23 16:24:05 host2 sshd[307655]: Disconnected from invalid user user 2.57.121.25 port 14332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 16:24:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Xlj53kBEWuKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 16:24:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<EE5J30BEWsErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 16:26:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<UPc85kBE0u12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 16:28:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<3ofR7EBEqtAEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 16:30:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<wNKL8kBEKqs+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 16:31:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<VavQ9kBE9FIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 16:32:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<O3Vz/EBE2rEv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 16:32:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<p9u4/EBEICNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 16:32:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=</UH+/EBErJ+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 16:33:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<vctT/0BESIAv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.133.197
country_id: 3077311
description:
Nov 23 16:36:37 host2 sshd[315857]: Disconnected from invalid user adiaz 194.87.133.197 port 46756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Nov 23 16:37:15 host2 sshd[316254]: Disconnected from invalid user jona 103.82.240.194 port 43336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 16:37:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<x86zDEFEvF+YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 16:37:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Qwf4DEFE6thA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 16:37:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<3rHADUFEBuHIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 16:38:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Dm0vEEFEhOaWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 23 16:39:07 host2 sshd[317351]: Disconnected from invalid user antonio 27.254.149.199 port 41368 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 16:39:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<pTeSE0FEetyl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 16:39:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<PC6aFEFEHMov+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Nov 23 16:39:52 host2 sshd[317779]: Disconnected from invalid user test5 103.82.240.194 port 49224 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 16:40:21 host2 sshd[318268]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 23 16:40:32 host2 sshd[318342]: Disconnected from invalid user steam 27.254.149.199 port 40266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 16:41:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<ZZL+GUFEpIMv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.59
country_id: 3175395
description:
Nov 23 16:41:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=195.177.113.59, lip=66.85.158.91, TLS, session=<7Z82GkFEJePDsXE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.36
country_id: 3469034
description:
Nov 23 16:41:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.39.142.36, lip=66.85.158.91, TLS, session=<VM5YG0FET8qxJ44k>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Nov 23 16:42:03 host2 sshd[319307]: Disconnected from invalid user user 202.152.201.166 port 45244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.133.197
country_id: 3077311
description:
Nov 23 16:43:24 host2 sshd[320156]: Disconnected from invalid user server 194.87.133.197 port 39876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 16:43:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<d4dSJEFE+OsI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Nov 23 16:43:10 host2 sshd[320018]: Disconnected from invalid user pujie 27.254.149.199 port 38052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 16:43:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<K6CtIUFEEqA+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 16:44:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z/LLJUFEPM1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Nov 23 16:44:52 host2 sshd[321088]: Disconnected from invalid user ts3server 202.152.201.166 port 43094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 16:45:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<UW82KEFECJw+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 16:46:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<iQC5LUFEFuAv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Nov 23 16:47:02 host2 sshd[322693]: Disconnected from invalid user deploy 103.82.240.194 port 41672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 16:47:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<LN5iMUFEiO0rpAFm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.117.21.211
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.117.21.211 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.160.42
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.160.42 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Nov 23 16:48:48 host2 sshd[323937]: Disconnected from invalid user fabric 202.152.201.166 port 39830 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.182.117.83
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.182.117.83 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.222.156.13
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 77.222.156.13 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.145.227.129
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.145.227.129 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.147.185.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.147.185.133 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.181.108.225
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.181.108.225 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.196.210.16
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.196.210.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 16:49:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ZTYjN0FEnJl2wSaf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.146.29.20
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.146.29.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.53.171.129
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.53.171.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.184.92.133
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 46.184.92.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.26.225.42
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.26.225.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 16:50:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<Bp/7O0FEjKIEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 16:50:34 host2 sshd[325140]: Disconnected from invalid user delia 62.60.131.157 port 25899 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 16:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pkt+PEFEWM+PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Nov 23 16:52:51 host2 sshd[326474]: Disconnected from invalid user steam 202.152.201.166 port 36582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 16:54:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<fOgcS0FEdB0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 16:56:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wtihUkFEkQlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 16:57:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<rOTfU0FEEKwv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 23 16:57:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<hW6VVEFEStynYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 16:57:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<4YACVkFESp7F8xBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.82
country_id: 1880251
description:
Nov 23 16:57:53 host2 sshd[329906]: Disconnected from invalid user ubuntu 101.47.140.82 port 42940 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 16:59:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<I5XSWkFECqAv+yXY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-23 16:59:35 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:51096: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-23 16:59:44 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:39224: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 17:00:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<ySSmXkFEUFWYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 17:00:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<wlD7XkFERtfIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Nov 23 17:02:03 host2 sshd[332609]: Disconnected from invalid user pelias 103.186.1.120 port 39920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 17:01:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<esFAY0FEPNZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Nov 23 17:02:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<C4XZZ0FE/K8+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.236.27
country_id: 1643084
description:
Nov 23 17:02:50 host2 sshd[333038]: Disconnected from invalid user ehsan 103.165.236.27 port 60864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 17:03:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=</25ZakFETtov7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 17:03:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<n1kZa0FE9uA+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 17:04:46 host2 sshd[335300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.236.27
country_id: 1643084
description:
Nov 23 17:04:23 host2 sshd[335055]: Disconnected from invalid user trias 103.165.236.27 port 34594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Nov 23 17:04:27 host2 sshd[335076]: Disconnected from invalid user ec2-user 103.186.1.120 port 51208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 23 17:05:14 host2 sshd[335748]: Disconnected from invalid user ec2-user 189.217.130.86 port 56566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.236.27
country_id: 1643084
description:
Nov 23 17:05:51 host2 sshd[336133]: Disconnected from invalid user mahsa 103.165.236.27 port 37842 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 17:06:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JQhidEFEwLQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 17:06:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tgxkdEFETr5n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 23 17:06:23 host2 sshd[336441]: Disconnected from invalid user abhi 189.217.130.86 port 25685 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 17:07:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<9mTTd0FEcKuWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 23 17:07:32 host2 sshd[337036]: Disconnected from invalid user nigger 189.217.130.86 port 58612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 17:08:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<qagmfEFEpoal6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.173.38.229
country_id: 2328926
description:
Nov 23 17:09:57 host2 sshd[338692]: Disconnected from invalid user user 62.173.38.229 port 55080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 23 17:10:03 host2 sshd[338833]: Disconnected from invalid user delia 62.60.131.157 port 40838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.165.236.27
country_id: 1643084
description:
Nov 23 17:10:10 host2 sshd[339008]: Disconnected from invalid user user2 103.165.236.27 port 34798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 17:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<A0fag0FEqKsrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.82
country_id: 1880251
description:
Nov 23 17:10:53 host2 sshd[339493]: Disconnected from invalid user sonaruser 101.47.140.82 port 40094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 23 17:11:38 host2 sshd[339894]: Disconnected from invalid user admin 196.196.253.20 port 44606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 17:11:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<E+Ouh0FEXuUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 17:11:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<eQmuiEFEEtgI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.173.38.229
country_id: 2328926
description:
Nov 23 17:11:18 host2 sshd[339768]: Disconnected from invalid user manager 62.173.38.229 port 46632 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 17:12:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ZatTiUFE4r92wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.173.38.229
country_id: 2328926
description:
Nov 23 17:12:34 host2 sshd[340406]: Disconnected from invalid user pzuser 62.173.38.229 port 37068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Nov 23 17:12:44 host2 sshd[340514]: Disconnected from invalid user p 103.186.1.120 port 60296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 17:12:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<aADOi0FEPKUEkXBg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 23 17:13:40 host2 sshd[341077]: Disconnected from invalid user kkk 196.196.253.20 port 44832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 17:14:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<abuse@agronatureholdings.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<O+pEkUFEjqs+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 23 17:14:45 host2 sshd[341812]: Disconnected from invalid user admin 196.196.253.20 port 44944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 23 17:15:51 host2 sshd[342513]: Disconnected from invalid user raju 196.196.253.20 port 45056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 23 17:15:54 host2 sshd[342559]: Disconnected from invalid user mule 143.110.137.94 port 57702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.93.22
country_id: 6252001
description:
Nov 23 17:16:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=3.134.93.22, lip=66.85.158.91, session=<rUSfl0FEoKsDhl0W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Nov 23 17:16:24 host2 sshd[342895]: Disconnected from invalid user ehsan 103.186.1.120 port 34354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 17:17:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Czibm0FEcLePbtX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 23 17:17:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, TLS, session=<Cf6bnEFEGsRHBobp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 17:18:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<s5vWnkFEhI8+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 17:18:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<HVqxoEFERCMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 23 17:19:18 host2 sshd[344576]: Disconnected from invalid user log 143.110.137.94 port 48600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 17:21:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<J0cdqUFEVrgv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 17:21:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<rccgqkFEThRniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 23 17:21:55 host2 sshd[346143]: Disconnected from invalid user dev 79.106.102.70 port 52802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.164.62.236
country_id: 660013
description:
Nov 23 17:22:07 host2 sshd[346248]: Disconnected from invalid user guest 104.164.62.236 port 53878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.199
country_id: 1269750
description:
Nov 23 17:22:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.164.246.199, lip=66.85.158.91, TLS, session=<MScgrkFEn7pnpPbH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.124
country_id: 3175395
description:
Nov 23 17:23:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.124.182.124, lip=66.85.158.91, TLS, session=<+BRLr0FEVZG5fLZ8>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.78
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.225.244.78 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.224.35.242
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.224.35.242 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 17:23:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<vfhusUFE8MfIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 17:23:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<BMUEskFE/EuYIMkL>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.204.107.158
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.204.107.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.31.42.62
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.31.42.62 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.96.157.229
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.96.157.229 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.227.165
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 51.36.227.165 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.255.9
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.201.255.9 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 23 17:24:15 host2 sshd[347465]: Disconnected from invalid user git 79.106.102.70 port 51584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 17:25:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<FEAMukFESo4v+yXY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 17:27:04 host2 sshd[349459]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 17:26:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<A4eou0FEIMMv7PP+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.164.62.236
country_id: 660013
description:
Nov 23 17:26:17 host2 sshd[348962]: Disconnected from invalid user backup 104.164.62.236 port 24818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 17:26:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<omlxu0FEGN9A44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.164.62.236
country_id: 660013
description:
Nov 23 17:27:15 host2 sshd[349557]: Disconnected from invalid user test2 104.164.62.236 port 29332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 17:28:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ea9bxEFEYsZn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.164.62.236
country_id: 660013
description:
Nov 23 17:29:16 host2 sshd[350757]: Disconnected from invalid user usr 104.164.62.236 port 24060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 23 17:31:05 host2 sshd[351882]: Disconnected from invalid user armin 143.110.137.94 port 46936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.82
country_id: 1880251
description:
Nov 23 17:31:26 host2 sshd[352138]: Disconnected from invalid user ec2-user 101.47.140.82 port 52158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 23 17:32:30 host2 sshd[352733]: Disconnected from invalid user user 2.57.121.25 port 47695 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 23 17:33:02 host2 sshd[353046]: Disconnected from invalid user temp 143.110.137.94 port 34432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 17:33:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HYw81EFE/J4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 17:33:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<77Ef1kFEiNcrpAFm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.106.102.70
country_id: 783754
description:
Nov 23 17:33:43 host2 sshd[353398]: Disconnected from invalid user deploy 79.106.102.70 port 56900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 17:35:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<hN1Z20FEfL4EkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 17:35:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<+MJb20FE5Mx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 17:36:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<BJDk4UFEbIUv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 17:36:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<Pn/74UFEsKSWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-23 17:38:02 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:31533: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 17:38:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<Afik5kFEzrGl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-11-23 17:38:24 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:59248: 535 Incorrect authentication data (set_id=parentscoignard111)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 17:39:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<lyv360FE3sMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 17:41:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MXIg80FEUKIvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-11-23 17:42:39 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:38866: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-23 17:42:49 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:59241: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-23 17:43:37 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:39302: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-23 17:43:50 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:51310: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 17:43:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<QxlT+EFEvu2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 17:44:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<nYNQ/EFEiJYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.142.9
country_id: 3469034
description:
Nov 23 17:45:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.39.142.9, lip=66.85.158.91, TLS, session=<PeY7AUJETaOxJ44J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 17:45:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<vmA/AkJEiLTIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 17:45:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4ajL/0FESB1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.107.193
country_id: 1269750
description:
Nov 23 17:45:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=103.87.107.193, lip=66.85.158.91, TLS, session=<apECAEJE9t5nV2vB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 17:46:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<xd2zBEJEakGYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Nov 23 17:47:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<abuse@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<3R77B0JEPtA+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 17:48:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<j55GDEJEVqwv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 17:50:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MDdGE0JEtp9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 17:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<pAERE0JEJMk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 17:51:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<HJAyF0JEuuov+yXY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.5
country_id: 6252001
description:
Nov 23 17:53:26 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.92, TLS, session=<ssQVHUJENqTLN4MF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 17:54:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<Y2ECIUJE/tNA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.100
country_id: 2635167
description:
Nov 23 17:54:41 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS, session=<KlKGIUJE35+594lk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 23 17:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.131.137, lip=66.85.158.91, session=<BuU9IkJEpOE+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 23 17:55:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lakwelholdings.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<gIYUI0JE0JQ+PIOK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 17:56:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<3AWyJ0JEFpQrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 17:57:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<S0JzKkJExpIEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 17:58:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<uHFLLUJEbqd2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 17:59:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vztzMkJEDIkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 18:02:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<svSUO0JEnN8v+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 23 18:02:18 host2 sshd[375533]: Disconnected from invalid user user 85.133.253.204 port 45754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 18:04:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<khP4Q0JEFHMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.94.206.38
country_id: 3469034
description:
Nov 23 18:04:38 host2 sshd[377506]: Disconnected from invalid user sam 177.94.206.38 port 53224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 18:04:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<ZQMRRkJEeMiWXx+e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.13.59
country_id: 6252001
description:
Nov 23 18:05:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.13.59, lip=66.85.158.91, session=<2+1RSUJEwuwv+w07>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 18:05:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<ktxvSUJEOOyl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Nov 23 18:05:55 host2 sshd[378341]: Disconnected from invalid user ubuntu 64.227.131.199 port 52850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 23 18:05:09 host2 sshd[377922]: Disconnected from invalid user sam 85.133.253.204 port 52376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 18:05:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<7cU6SEJE6qc+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.94.206.38
country_id: 3469034
description:
Nov 23 18:06:16 host2 sshd[378519]: Disconnected from invalid user ubuntu 177.94.206.38 port 55680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.253.204
country_id: 130758
description:
Nov 23 18:06:25 host2 sshd[378590]: Disconnected from invalid user jupyter 85.133.253.204 port 37790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Nov 23 18:06:36 host2 sshd[378676]: Disconnected from invalid user openkm 163.181.207.222 port 48184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 18:06:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<PhW9TEJERLAI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 18:07:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<2wIJTkJERrwv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.253.204
country_id: 130758
description:
Nov 23 18:07:35 host2 sshd[379159]: Disconnected from invalid user jonas 85.133.253.204 port 39640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.94.206.38
country_id: 3469034
description:
Nov 23 18:07:51 host2 sshd[379336]: Disconnected from invalid user jonas 177.94.206.38 port 58144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 18:08:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<ZBWwU0JEJIjIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 18:08:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<bvIJVEJERo6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 18:09:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pjt+VUJEsyZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.94.206.38
country_id: 3469034
description:
Nov 23 18:09:19 host2 sshd[380369]: Disconnected from invalid user user 177.94.206.38 port 60598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Nov 23 18:10:19 host2 sshd[381159]: Disconnected from invalid user tunnel 163.181.207.222 port 44680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 23 18:10:24 host2 sshd[381195]: Disconnected from invalid user openkm 92.191.96.115 port 39298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.94.206.38
country_id: 3469034
description:
Nov 23 18:10:47 host2 sshd[381356]: Disconnected from invalid user ec2-user 177.94.206.38 port 34820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 18:10:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<K4G9WEJEHDiYIMkL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Nov 23 18:11:17 host2 sshd[381659]: Disconnected from invalid user jonas 64.227.131.199 port 54012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.243.16.90
country_id: 49518
description:
Nov 23 18:11:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=197.243.16.90, lip=66.85.158.91, session=<ilzuXEJENoHF8xBa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 18:11:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<zazIXUJETJUv7PP+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 23 18:11:42 host2 sshd[381840]: Disconnected from invalid user marco 92.191.96.115 port 35932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-23 18:11:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49455: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 18:13:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<gVenY0JElo9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Nov 23 18:14:14 host2 sshd[383935]: Disconnected from invalid user mule 64.227.131.199 port 41280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Nov 23 18:15:43 host2 sshd[385114]: Disconnected from invalid user abdul 64.227.131.199 port 50440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.215.177.203
country_id: 1168579
description:
Nov 23 18:15:56 host2 sshd[385252]: Disconnected from invalid user ec2-user 203.215.177.203 port 32496 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Nov 23 18:15:19 host2 sshd[384911]: Disconnected from invalid user akbar 92.191.96.115 port 62530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 18:17:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<oUakckJEvtgv+yXY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.215.177.203
country_id: 1168579
description:
Nov 23 18:18:22 host2 sshd[386791]: Disconnected from invalid user user 203.215.177.203 port 6270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 18:18:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<NB5gdkJEwptA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 18:19:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<Re6/ekJExr8rpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 18:19:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<CWPpekJE/tkEkXBg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.215.177.203
country_id: 1168579
description:
Nov 23 18:19:57 host2 sshd[387881]: Disconnected from invalid user student5 203.215.177.203 port 3352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 18:20:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<apVnfUJEeMk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 18:20:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Y0FdfkJEuqk+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 23 18:21:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xIsNgUJE3spChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 18:21:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<0bxNgUJEAuN2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.215.177.203
country_id: 1168579
description:
Nov 23 18:21:44 host2 sshd[389135]: Disconnected from invalid user opennms 203.215.177.203 port 40304 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.173.139.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.173.139.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.235.160.194
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 86.235.160.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.44.9.1
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 110.44.9.1 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.255.93
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.94.255.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.214.210.205
country_id: 1512440
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.214.210.205 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.18.39.69
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.18.39.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.66.234.194
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.66.234.194 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Nov 23 18:23:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<RP6CiUJEMpM+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Nov 23 18:24:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Hl+yikJE2Mw+PIcg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 18:24:32 host2 sshd[391618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 18:25:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<EPZUjkJEbOMv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 23 18:26:23 host2 sshd[393217]: Disconnected from invalid user tunnel 175.100.24.139 port 38828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 18:26:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<sSnUk0JEvuMv+3xn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 18:27:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<3n9plUJEwhIvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-11-23 18:29:46 dovecot_login authenticator failed for c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:47238: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 18:30:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<nJDioEJENtMv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-23 18:30:31 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:49724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 18:31:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<M2lWpkJE5NvIMGRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Nov 23 18:32:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<+1lvqEJEVNw+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 18:32:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pxelqUJElC9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 23 18:33:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<xAMzq0JELpiWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 18:33:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<md7+q0JESpwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 18:33:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<12iYrEJEqi6YIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Nov 23 18:33:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<lUntrEJEdqCl6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 18:34:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JRYPrkJE5ruPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 18:34:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<LkUlr0JEau0v7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 18:35:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6oyutEJEANZn9M4G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 23 18:37:08 host2 sshd[400332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Nov 23 18:38:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<28HHvkJEmsY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Nov 23 18:39:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<658vwUJEUKM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 4.145.112.96
country_id: 1880251
description:
Nov 23 18:42:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=4.145.112.96, lip=66.85.158.91, session=<to58y0JE/MoEkXBg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 23 18:42:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<IRbazEJE/JdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.37.216
country_id: 6252001
description:
Nov 23 18:42:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=47.251.37.216, lip=66.85.158.91, session=<NfizzUJE1MYv+yXY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Nov 23 18:42:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<CSIBzkJE9uwrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 23 18:45:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<fcMo1kJE1Nt2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.200
country_id: 3469034
description:
Nov 23 18:46:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=186.209.247.200, lip=66.85.158.91, TLS, session=<X3Ta2kJEjNi60ffI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Nov 23 18:48:10 host2 sshd[407788]: Disconnected from invalid user max 5.182.26.99 port 52184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.44.99
country_id: 953987
description:
Nov 23 18:47:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.64.44.99, lip=66.85.158.91, TLS, session=<bF8k3EJE6NxmQCxj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Nov 23 18:49:33 host2 sshd[408689]: Disconnected from invalid user luo 5.182.26.99 port 41922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 23 18:49:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1+6V5kJE+v0vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 23 18:50:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<9zNs6kJEPM0v+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.26.99
country_id: 1512440
description:
Nov 23 18:50:58 host2 sshd[409856]: Disconnected from invalid user jupyter 5.182.26.99 port 58704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.124.103
country_id: 6252001
description:
Nov 23 18:51:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=47.251.124.103, lip=66.85.158.91, session=<f4xc7EJE/oAv+3xn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Nov 23 18:52:22 host2 sshd[411012]: Disconnected from invalid user oleg 5.182.26.99 port 42096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 23 18:53:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<HUbN80JEgo4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.48.100.83
country_id: 3932488
description:
Nov 23 18:54:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=200.48.100.83, lip=66.85.158.91, session=<dxi++EJENNjIMGRT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Nov 23 18:54:54 host2 sshd[413094]: Disconnected from invalid user jellyfin 5.182.26.99 port 40130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Nov 23 18:56:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<BHf9/UJEazdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 23 18:56:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=152.32.201.11, lip=66.85.158.91, session=<btM8AENEVvyYIMkL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 23 18:57:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<1Wh+AENEttYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 23 18:58:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<LprwBkNEptJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 18:58:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<YiQ2B0NEgKQ+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.160.51
country_id: 3469034
description:
Nov 23 18:59:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=187.109.160.51, lip=66.85.158.91, TLS, session=<lKhwCENEQpq7baAz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.44.105
country_id: 953987
description:
Nov 23 18:59:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=102.64.44.105, lip=66.85.158.91, TLS, session=<AHSmCUNEpJhmQCxp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Nov 23 19:00:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<XMIlC0NEZI4+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Nov 23 19:00:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<UT1AC0NEvKC58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Nov 23 18:59:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<8KyqCENEJOuPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 23 19:00:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<q/XJDUNEjug+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Nov 23 19:00:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<lcXjC0NEgogI04Sw>


