# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.161.3.29
country_id: 6252001
description:
[2025-12-02 14:05:15 +0530] info [cpaneld] 47.161.3.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.7.144.210
country_id: 6252001
description:
[2025-12-02 14:05:21 +0530] info [cpaneld] 75.7.144.210 - ajsstarlo "GET /login/?login_only=1&user=ajsstarlo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarlo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.125.101
country_id: 6252001
description:
[2025-12-02 14:05:24 +0530] info [cpaneld] 107.221.125.101 - ajsst "GET /login/?login_only=1&user=ajsst&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsst (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.242.175
country_id: 6252001
description:
[2025-12-02 14:05:25 +0530] info [cpaneld] 47.154.242.175 - ajss "GET /login/?login_only=1&user=ajss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.5.53.220
country_id: 6252001
description:
[2025-12-02 14:05:28 +0530] info [cpaneld] 24.5.53.220 - ajsstar1 "GET /login/?login_only=1&user=ajsstar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.72.78.62
country_id: 6252001
description:
[2025-12-02 14:05:27 +0530] info [cpaneld] 172.72.78.62 - aj "GET /login/?login_only=1&user=aj&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aj (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.41.38.79
country_id: 6252001
description:
[2025-12-02 14:05:29 +0530] info [cpaneld] 98.41.38.79 - ajsstar2 "GET /login/?login_only=1&user=ajsstar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.82.194.204
country_id: 6252001
description:
[2025-12-02 14:05:22 +0530] info [cpaneld] 99.82.194.204 - ajsstar "GET /login/?login_only=1&user=ajsstar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.230.192.177
country_id: 6252001
description:
[2025-12-02 14:05:22 +0530] info [cpaneld] 162.230.192.177 - ajsstarl "GET /login/?login_only=1&user=ajsstarl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.213.4.201
country_id: 6252001
description:
[2025-12-02 14:05:24 +0530] info [cpaneld] 67.213.4.201 - ajssta "GET /login/?login_only=1&user=ajssta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.244.51.238
country_id: 6252001
description:
[2025-12-02 14:05:26 +0530] info [cpaneld] 136.244.51.238 - ajs "GET /login/?login_only=1&user=ajs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.170.47
country_id: 6252001
description:
[2025-12-02 14:06:38 +0530] info [cpaneld] 47.157.170.47 - manaharasupercente "GET /login/?login_only=1&user=manaharasupercente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.143.196.174
country_id: 6252001
description:
[2025-12-02 14:06:46 +0530] info [cpaneld] 76.143.196.174 - manaharasupe "GET /login/?login_only=1&user=manaharasupe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.200.5.108
country_id: 6252001
description:
[2025-12-02 14:06:48 +0530] info [cpaneld] 73.200.5.108 - manaharasu "GET /login/?login_only=1&user=manaharasu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.95.10.49
country_id: 6252001
description:
[2025-12-02 14:06:34 +0530] info [cpaneld] 204.95.10.49 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.180.27.52
country_id: 6252001
description:
[2025-12-02 14:06:34 +0530] info [cpaneld] 70.180.27.52 - manaharasupercenter "GET /login/?login_only=1&user=manaharasupercenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.35.204.244
country_id: 6252001
description:
[2025-12-02 14:06:37 +0530] info [cpaneld] 72.35.204.244 - manaharasupercenterlk "GET /login/?login_only=1&user=manaharasupercenterlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercenterlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.2.124.228
country_id: 6252001
description:
[2025-12-02 14:06:39 +0530] info [cpaneld] 24.2.124.228 - manaharasupercent "GET /login/?login_only=1&user=manaharasupercent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.84.12.127
country_id: 6252001
description:
[2025-12-02 14:06:41 +0530] info [cpaneld] 67.84.12.127 - manaharasuperce "GET /login/?login_only=1&user=manaharasuperce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.150.186.154
country_id: 6252001
description:
[2025-12-02 14:06:44 +0530] info [cpaneld] 169.150.186.154 - manaharasuper "GET /login/?login_only=1&user=manaharasuper&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuper (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.231.162.82
country_id: 6252001
description:
[2025-12-02 14:06:47 +0530] info [cpaneld] 96.231.162.82 - manaharasup "GET /login/?login_only=1&user=manaharasup&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasup (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.123.40
country_id: 6252001
description:
[2025-12-02 14:06:52 +0530] info [cpaneld] 47.147.123.40 - manahara "GET /login/?login_only=1&user=manahara&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahara (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.30.109.204
country_id: 6252001
description:
[2025-12-02 14:06:33 +0530] info [cpaneld] 76.30.109.204 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.137.163.99
country_id: 6252001
description:
[2025-12-02 14:06:55 +0530] info [cpaneld] 76.137.163.99 - manah "GET /login/?login_only=1&user=manah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.38.207.228
country_id: 6252001
description:
[2025-12-02 14:06:57 +0530] info [cpaneld] 73.38.207.228 - man "GET /login/?login_only=1&user=man&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user man (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.42.99.17
country_id: 6252001
description:
[2025-12-02 14:06:56 +0530] info [cpaneld] 50.42.99.17 - mana "GET /login/?login_only=1&user=mana&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mana (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.20.218.57
country_id: 6252001
description:
[2025-12-02 14:07:03 +0530] info [cpaneld] 24.20.218.57 - ma "GET /login/?login_only=1&user=ma&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ma (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.245.187.8
country_id: 6252001
description:
[2025-12-02 14:07:04 +0530] info [cpaneld] 168.245.187.8 - manahar1 "GET /login/?login_only=1&user=manahar1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.53.204.75
country_id: 6252001
description:
[2025-12-02 14:06:51 +0530] info [cpaneld] 104.53.204.75 - manaharas "GET /login/?login_only=1&user=manaharas&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharas (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.189.74.230
country_id: 6252001
description:
[2025-12-02 14:06:53 +0530] info [cpaneld] 104.189.74.230 - manahar "GET /login/?login_only=1&user=manahar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.175.72.182
country_id: 6252001
description:
[2025-12-02 14:06:40 +0530] info [cpaneld] 99.175.72.182 - manaharasupercen "GET /login/?login_only=1&user=manaharasupercen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasupercen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.34.218.121
country_id: 6252001
description:
[2025-12-02 14:06:42 +0530] info [cpaneld] 38.34.218.121 - manaharasuperc "GET /login/?login_only=1&user=manaharasuperc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaharasuperc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.64.208.142
country_id: 6252001
description:
[2025-12-02 14:06:54 +0530] info [cpaneld] 68.64.208.142 - manaha "GET /login/?login_only=1&user=manaha&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manaha (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.54.223.56
country_id: 6252001
description:
[2025-12-02 14:07:05 +0530] info [cpaneld] 174.54.223.56 - manahar2 "GET /login/?login_only=1&user=manahar2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user manahar2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.123.106.232
country_id: 6252001
description:
[2025-12-02 14:06:36 +0530] info [whostmgrd] 76.123.106.232 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.92.32.12
country_id: 6252001
description:
[2025-12-02 14:09:01 +0530] info [cpaneld] 64.92.32.12 - lankaher "GET /login/?login_only=1&user=lankaher&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.224.43.74
country_id: 6252001
description:
[2025-12-02 14:08:39 +0530] info [cpaneld] 96.224.43.74 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.196.52.128
country_id: 6252001
description:
[2025-12-02 14:08:40 +0530] info [whostmgrd] 71.196.52.128 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.238.79.9
country_id: 6252001
description:
[2025-12-02 14:08:45 +0530] info [cpaneld] 73.238.79.9 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.139.98
country_id: 6252001
description:
[2025-12-02 14:08:46 +0530] info [cpaneld] 69.138.139.98 - lankaherbalsolutions "GET /login/?login_only=1&user=lankaherbalsolutions&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutions (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.10.250.10
country_id: 6252001
description:
[2025-12-02 14:08:51 +0530] info [cpaneld] 99.10.250.10 - lankaherbalsolut "GET /login/?login_only=1&user=lankaherbalsolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.237.22.3
country_id: 6252001
description:
[2025-12-02 14:08:53 +0530] info [cpaneld] 24.237.22.3 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.182.168.98
country_id: 6252001
description:
[2025-12-02 14:08:55 +0530] info [cpaneld] 104.182.168.98 - lankaherbalsol "GET /login/?login_only=1&user=lankaherbalsol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsol (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.174.166.9
country_id: 6252001
description:
[2025-12-02 14:08:44 +0530] info [cpaneld] 104.174.166.9 - lezzarote "GET /login/?login_only=1&user=lezzarote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.75.147.56
country_id: 6252001
description:
[2025-12-02 14:08:48 +0530] info [cpaneld] 149.75.147.56 - lankaherbalsolution "GET /login/?login_only=1&user=lankaherbalsolution&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolution (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.166.48.91
country_id: 6252001
description:
[2025-12-02 14:08:55 +0530] info [cpaneld] 24.166.48.91 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.45.133.225
country_id: 6252001
description:
[2025-12-02 14:09:07 +0530] info [cpaneld] 71.45.133.225 - lanka "GET /login/?login_only=1&user=lanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.28.106.44
country_id: 6252001
description:
[2025-12-02 14:09:10 +0530] info [cpaneld] 75.28.106.44 - lankahe1 "GET /login/?login_only=1&user=lankahe1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.184.86.147
country_id: 6252001
description:
[2025-12-02 14:08:32 +0530] info [cpaneld] 67.184.86.147 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.209.162.13
country_id: 6252001
description:
[2025-12-02 14:08:49 +0530] info [cpaneld] 98.209.162.13 - lankaherbalsolutio "GET /login/?login_only=1&user=lankaherbalsolutio&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutio (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.133.31.231
country_id: 6252001
description:
[2025-12-02 14:08:54 +0530] info [cpaneld] 47.133.31.231 - lankaherbalsolu "GET /login/?login_only=1&user=lankaherbalsolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.129.188.101
country_id: 6252001
description:
[2025-12-02 14:08:57 +0530] info [cpaneld] 73.129.188.101 - lankaherbals "GET /login/?login_only=1&user=lankaherbals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbals (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.32.70.142
country_id: 6252001
description:
[2025-12-02 14:09:08 +0530] info [cpaneld] 136.32.70.142 - lank "GET /login/?login_only=1&user=lank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.137.22
country_id: 6252001
description:
[2025-12-02 14:09:10 +0530] info [cpaneld] 73.158.137.22 - la "GET /login/?login_only=1&user=la&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user la (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.183.194.81
country_id: 6252001
description:
[2025-12-02 14:08:43 +0530] info [cpaneld] 71.183.194.81 - lezzarotec "GET /login/?login_only=1&user=lezzarotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.112.85.162
country_id: 6252001
description:
[2025-12-02 14:08:44 +0530] info [cpaneld] 24.112.85.162 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.128.75.206
country_id: 6252001
description:
[2025-12-02 14:08:46 +0530] info [whostmgrd] 24.128.75.206 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.25.169.203
country_id: 6252001
description:
[2025-12-02 14:08:47 +0530] info [cpaneld] 137.25.169.203 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.14.151.17
country_id: 6252001
description:
[2025-12-02 14:09:00 +0530] info [cpaneld] 100.14.151.17 - lankaherb "GET /login/?login_only=1&user=lankaherb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.153.142
country_id: 6252001
description:
[2025-12-02 14:09:02 +0530] info [cpaneld] 24.4.153.142 - lankahe "GET /login/?login_only=1&user=lankahe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.36.186.181
country_id: 6252001
description:
[2025-12-02 14:08:47 +0530] info [cpaneld] 98.36.186.181 - lankaherbalsolutionscom "GET /login/?login_only=1&user=lankaherbalsolutionscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsolutionscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.35.126.5
country_id: 6252001
description:
[2025-12-02 14:08:54 +0530] info [cpaneld] 73.35.126.5 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.130.133
country_id: 6252001
description:
[2025-12-02 14:08:56 +0530] info [cpaneld] 172.59.130.133 - lankaherbalso "GET /login/?login_only=1&user=lankaherbalso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.9.148.208
country_id: 6252001
description:
[2025-12-02 14:08:56 +0530] info [cpaneld] 104.9.148.208 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.187.207.168
country_id: 6252001
description:
[2025-12-02 14:09:09 +0530] info [cpaneld] 67.187.207.168 - lan "GET /login/?login_only=1&user=lan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.202.154.122
country_id: 6252001
description:
[2025-12-02 14:08:45 +0530] info [cpaneld] 104.202.154.122 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.120.61.204
country_id: 6252001
description:
[2025-12-02 14:08:46 +0530] info [cpaneld] 70.120.61.204 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.116.163.16
country_id: 6252001
description:
[2025-12-02 14:08:47 +0530] info [cpaneld] 85.116.163.16 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.14.106
country_id: 6252001
description:
[2025-12-02 14:08:58 +0530] info [cpaneld] 76.33.14.106 - lankaherbal "GET /login/?login_only=1&user=lankaherbal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.53.7.190
country_id: 6252001
description:
[2025-12-02 14:09:05 +0530] info [cpaneld] 69.53.7.190 - lankah "GET /login/?login_only=1&user=lankah&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankah (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.64.110.101
country_id: 6252001
description:
[2025-12-02 14:09:11 +0530] info [cpaneld] 148.64.110.101 - lankahe2 "GET /login/?login_only=1&user=lankahe2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankahe2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.182.116.77
country_id: 6252001
description:
[2025-12-02 14:08:39 +0530] info [cpaneld] 209.182.116.77 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 16.98.111.188
country_id: 6252001
description:
[2025-12-02 14:08:42 +0530] info [cpaneld] 16.98.111.188 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.192.201.8
country_id: 6252001
description:
[2025-12-02 14:08:48 +0530] info [cpaneld] 73.192.201.8 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.33.12.252
country_id: 6252001
description:
[2025-12-02 14:08:50 +0530] info [cpaneld] 68.33.12.252 - lankaherbalsoluti "GET /login/?login_only=1&user=lankaherbalsoluti&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherbalsoluti (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.205.175
country_id: 6252001
description:
[2025-12-02 14:08:59 +0530] info [cpaneld] 45.48.205.175 - lankaherba "GET /login/?login_only=1&user=lankaherba&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lankaherba (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.210.194
country_id: 719819
description:
Dec  2 14:09:34 host2 sshd[1836312]: Disconnected from invalid user ubuntu 195.199.210.194 port 38906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-02 14:11:01 dovecot_plain authenticator failed for (untentra) [178.250.191.189]:58308: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.149
country_id: 2661886
description:
2025-12-02 14:12:07 dovecot_login authenticator failed for 95.209.141.149.bredband.tre.se [95.209.141.149]:36762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.12.190.167
country_id: 6252001
description:
[2025-12-02 14:12:10 +0530] info [cpaneld] 73.12.190.167 - ayuzonelanka "GET /login/?login_only=1&user=ayuzonelanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.222.177.238
country_id: 6252001
description:
[2025-12-02 14:12:10 +0530] info [whostmgrd] 216.222.177.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.210.168.110
country_id: 6252001
description:
[2025-12-02 14:12:13 +0530] info [cpaneld] 47.210.168.110 - ayuzonelank "GET /login/?login_only=1&user=ayuzonelank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.181.165.146
country_id: 6252001
description:
[2025-12-02 14:12:16 +0530] info [cpaneld] 24.181.165.146 - ayuzonela "GET /login/?login_only=1&user=ayuzonela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.46.6.167
country_id: 6252001
description:
[2025-12-02 14:12:14 +0530] info [cpaneld] 45.46.6.167 - ayuzonelan "GET /login/?login_only=1&user=ayuzonelan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.243.73.51
country_id: 6252001
description:
[2025-12-02 14:12:17 +0530] info [cpaneld] 98.243.73.51 - ayuzonel "GET /login/?login_only=1&user=ayuzonel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.114.130.252
country_id: 6252001
description:
[2025-12-02 14:12:20 +0530] info [cpaneld] 76.114.130.252 - ayuzone "GET /login/?login_only=1&user=ayuzone&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.144.154
country_id: 6252001
description:
[2025-12-02 14:12:09 +0530] info [cpaneld] 73.23.144.154 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.154.200.246
country_id: 6252001
description:
[2025-12-02 14:12:12 +0530] info [cpaneld] 69.154.200.246 - ayuzonelankacom "GET /login/?login_only=1&user=ayuzonelankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzonelankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.43.184.28
country_id: 6252001
description:
[2025-12-02 14:12:21 +0530] info [cpaneld] 50.43.184.28 - ayuzon "GET /login/?login_only=1&user=ayuzon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.194.137
country_id: 6252001
description:
[2025-12-02 14:12:02 +0530] info [cpaneld] 38.44.194.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.177.169.41
country_id: 6252001
description:
[2025-12-02 14:12:28 +0530] info [cpaneld] 67.177.169.41 - ayuzone1 "GET /login/?login_only=1&user=ayuzone1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.94.76.158
country_id: 6252001
description:
[2025-12-02 14:13:13 +0530] info [cpaneld] 70.94.76.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.202.32.124
country_id: 6252001
description:
[2025-12-02 14:13:15 +0530] info [whostmgrd] 162.202.32.124 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.179.157.23
country_id: 6252001
description:
[2025-12-02 14:13:19 +0530] info [cpaneld] 76.179.157.23 - ceylondige "GET /login/?login_only=1&user=ceylondige&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondige (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.148.99.152
country_id: 6252001
description:
[2025-12-02 14:12:25 +0530] info [cpaneld] 35.148.99.152 - ayu "GET /login/?login_only=1&user=ayu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.1.122.243
country_id: 6252001
description:
[2025-12-02 14:13:09 +0530] info [cpaneld] 100.1.122.243 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.249.235.243
country_id: 6252001
description:
[2025-12-02 14:12:23 +0530] info [cpaneld] 96.249.235.243 - ayuz "GET /login/?login_only=1&user=ayuz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.26.241
country_id: 6252001
description:
[2025-12-02 14:12:27 +0530] info [cpaneld] 98.97.26.241 - ay "GET /login/?login_only=1&user=ay&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ay (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.197.136
country_id: 6252001
description:
[2025-12-02 14:13:16 +0530] info [cpaneld] 73.252.197.136 - ceylondigestcom "GET /login/?login_only=1&user=ceylondigestcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondigestcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.75.55.6
country_id: 6252001
description:
[2025-12-02 14:13:18 +0530] info [cpaneld] 74.75.55.6 - ceylondiges "GET /login/?login_only=1&user=ceylondiges&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondiges (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.119.33
country_id: 6252001
description:
[2025-12-02 14:12:22 +0530] info [cpaneld] 135.129.119.33 - ayuzo "GET /login/?login_only=1&user=ayuzo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.160.43.5
country_id: 6252001
description:
[2025-12-02 14:12:29 +0530] info [cpaneld] 67.160.43.5 - ayuzone2 "GET /login/?login_only=1&user=ayuzone2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ayuzone2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.137.142.246
country_id: 1655842
description:
2025-12-02 14:12:34 dovecot_login authenticator failed for ([202.137.142.246]) [202.137.142.246]:43105: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.135.42
country_id: 6252001
description:
[2025-12-02 14:13:14 +0530] info [cpaneld] 73.66.135.42 - ceylondigest "GET /login/?login_only=1&user=ceylondigest&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.142.57.58
country_id: 6252001
description:
[2025-12-02 14:13:28 +0530] info [cpaneld] 75.142.57.58 - ceyl "GET /login/?login_only=1&user=ceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.196.254.122
country_id: 6252001
description:
[2025-12-02 14:13:27 +0530] info [cpaneld] 162.196.254.122 - ceylo "GET /login/?login_only=1&user=ceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.46.252.15
country_id: 6252001
description:
[2025-12-02 14:13:22 +0530] info [cpaneld] 98.46.252.15 - ceylondig "GET /login/?login_only=1&user=ceylondig&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondig (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.194.173.81
country_id: 6252001
description:
[2025-12-02 14:13:24 +0530] info [cpaneld] 73.194.173.81 - ceylond "GET /login/?login_only=1&user=ceylond&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.175.139.153
country_id: 6252001
description:
[2025-12-02 14:13:29 +0530] info [cpaneld] 173.175.139.153 - cey "GET /login/?login_only=1&user=cey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.147.137.180
country_id: 6252001
description:
[2025-12-02 14:13:30 +0530] info [cpaneld] 24.147.137.180 - ce "GET /login/?login_only=1&user=ce&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ce (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.10.46.98
country_id: 6252001
description:
[2025-12-02 14:13:31 +0530] info [cpaneld] 73.10.46.98 - ceylond1 "GET /login/?login_only=1&user=ceylond1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.87.81.112
country_id: 6252001
description:
[2025-12-02 14:13:23 +0530] info [cpaneld] 72.87.81.112 - ceylondi "GET /login/?login_only=1&user=ceylondi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.80.186.180
country_id: 6252001
description:
[2025-12-02 14:13:26 +0530] info [cpaneld] 71.80.186.180 - ceylon "GET /login/?login_only=1&user=ceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.11.37.175
country_id: 6252001
description:
[2025-12-02 14:13:34 +0530] info [cpaneld] 98.11.37.175 - ceylond2 "GET /login/?login_only=1&user=ceylond2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylond2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.158.147.251
country_id: 6252001
description:
[2025-12-02 14:15:12 +0530] info [cpaneld] 24.158.147.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.97.125.129
country_id: 6252001
description:
[2025-12-02 14:15:14 +0530] info [cpaneld] 68.97.125.129 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.66.214.49
country_id: 6252001
description:
[2025-12-02 14:15:20 +0530] info [cpaneld] 73.66.214.49 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.174.137
country_id: 6252001
description:
[2025-12-02 14:15:10 +0530] info [cpaneld] 47.154.174.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.36.124.96
country_id: 6252001
description:
[2025-12-02 14:15:16 +0530] info [whostmgrd] 74.36.124.96 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 14:15:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<K+WMHfREBswXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec  2 14:14:45 host2 sshd[1839319]: Disconnected from invalid user sonarqube 191.185.168.78 port 53854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.204.227.190
country_id: 6252001
description:
Dec  2 14:16:06 host2 sshd[1840189]: Disconnected from invalid user minecraft 15.204.227.190 port 57236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-02 14:16:21 dovecot_login authenticator failed for ([110.189.153.136]) [152.52.192.74]:53100: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.137.152
country_id: 6252001
description:
[2025-12-02 14:15:25 +0530] info [cpaneld] 76.33.137.152 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.69.5.99
country_id: 6252001
description:
[2025-12-02 14:15:30 +0530] info [cpaneld] 174.69.5.99 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.253.11.9
country_id: 6252001
description:
[2025-12-02 14:15:32 +0530] info [cpaneld] 73.253.11.9 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.107.8.245
country_id: 6252001
description:
[2025-12-02 14:15:23 +0530] info [cpaneld] 68.107.8.245 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.245.29.120
country_id: 6252001
description:
[2025-12-02 14:15:35 +0530] info [cpaneld] 24.245.29.120 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-02 14:15:54 dovecot_plain authenticator failed for (kilgaliss) [102.53.15.17]:57128: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-02 14:16:06 dovecot_login authenticator failed for ([61.32.221.143]) [125.19.248.170]:38902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.141.247.8
country_id: 6252001
description:
[2025-12-02 14:15:22 +0530] info [cpaneld] 65.141.247.8 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.185.85.202
country_id: 6252001
description:
[2025-12-02 14:15:26 +0530] info [cpaneld] 47.185.85.202 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.184.193.67
country_id: 6252001
description:
2025-12-02 14:16:29 dovecot_login authenticator failed for ([194.179.135.174]) [137.184.193.67]:52056: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 14:17:10 host2 sshd[1840771]: Disconnected from invalid user 1234 2.57.121.112 port 63253 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.204.227.190
country_id: 6252001
description:
Dec  2 14:18:08 host2 sshd[1841272]: Disconnected from invalid user gg 15.204.227.190 port 44276 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  2 14:17:41 host2 sshd[1841010]: User agentallianz from 62.60.135.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec  2 14:17:43 host2 sshd[1841018]: Disconnected from invalid user qw 191.185.168.78 port 52574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.38
country_id: 298795
description:
Dec  2 14:18:38 host2 sshd[1841651]: Disconnected from invalid user kyt 213.142.151.38 port 33240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.210.194
country_id: 719819
description:
Dec  2 14:18:59 host2 sshd[1841795]: Disconnected from invalid user sftpuser 195.199.210.194 port 34812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.38
country_id: 298795
description:
Dec  2 14:20:12 host2 sshd[1842612]: Disconnected from invalid user testuser 213.142.151.38 port 54406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.105
country_id: 6252001
description:
2025-12-02 14:19:24 dovecot_login authenticator failed for (ADMIN) [191.96.37.105]:25045: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-02 14:20:37 dovecot_plain authenticator failed for (herrehous) [154.144.255.208]:59676: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Dec  2 14:20:50 host2 sshd[1843046]: Disconnected from invalid user pivpn 191.185.168.78 port 51652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-02 14:21:03 dovecot_login authenticator failed for ([127.0.0.1]) [182.79.87.18]:52672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.204.216.60
country_id: 2661886
description:
2025-12-02 14:21:15 dovecot_login authenticator failed for ([127.0.0.1]) [213.204.216.60]:55324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.38
country_id: 298795
description:
Dec  2 14:21:44 host2 sshd[1843604]: Disconnected from invalid user gg 213.142.151.38 port 49130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.217
country_id: 1880251
description:
Dec  2 14:21:27 host2 sshd[1843450]: Disconnected from invalid user client 45.78.227.217 port 55380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-02 14:23:06 dovecot_login authenticator failed for ([58.58.130.22]) [93.85.230.107]:55394: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-02 14:23:30 dovecot_login authenticator failed for ([186.5.178.229]) [50.188.204.213]:54409: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  2 14:23:48 host2 sshd[1845045]: User agentallianz from 62.60.135.108 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.53.126.26
country_id: 2661886
description:
[2025-12-02 14:24:21 +0530] info [cpaneld] 13.53.126.26 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.157.169
country_id: 99237
description:
Dec  2 14:25:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.157.169, lip=66.85.158.91, TLS, session=<zQb1P/REf6FBFJ2p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.175
country_id: 3469034
description:
Dec  2 14:24:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.89.136.175, lip=66.85.158.91, TLS, session=<Je/GPvREdpy+WYiv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 14:25:56 +0530] info [cpaneld] 43.245.222.27 - yashih "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashih (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Dec  2 14:27:14 host2 sshd[1847212]: Disconnected from invalid user gg 95.39.201.205 port 34430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.39.201.205
country_id: 2510769
description:
Dec  2 14:32:15 host2 sshd[1849899]: Disconnected from invalid user roots 95.39.201.205 port 49486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 14:35:07 host2 sshd[1851828]: Disconnected from invalid user admin 2.57.121.112 port 46461 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.21.152
country_id: 2750405
description:
2025-12-02 14:38:11 dovecot_login authenticator failed for (ADMIN) [158.173.21.152]:55564: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-02 14:39:20 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:42929: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-12-02 14:39:42 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:55003: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 14:42:01 host2 sshd[1856963]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.82
country_id: 6252001
description:
Dec  2 14:41:23 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.82, lip=66.85.158.91, TLS, session=<GjLMevRErOWTuYRS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec  2 14:42:51 host2 sshd[1857546]: Disconnected from invalid user g 194.233.74.228 port 39552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 14:44:15 host2 sshd[1858497]: Disconnected from invalid user user 2.57.121.25 port 40241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.217
country_id: 1880251
description:
Dec  2 14:45:42 host2 sshd[1859756]: Disconnected from invalid user admin1 45.78.227.217 port 46168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec  2 14:46:53 host2 sshd[1860674]: Disconnected from invalid user tuan 194.233.74.228 port 33780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.233.74.228
country_id: 1880251
description:
Dec  2 14:48:22 host2 sshd[1862038]: Disconnected from invalid user ntps 194.233.74.228 port 50774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-02 14:48:33 dovecot_plain authenticator failed for (euted) [23.30.11.253]:53150: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.233.74.228
country_id: 1880251
description:
Dec  2 14:52:44 host2 sshd[1864823]: Disconnected from invalid user postgres 194.233.74.228 port 47346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.7
country_id: 614540
description:
2025-12-02 15:00:02 dovecot_login authenticator failed for (ADMIN) [95.181.236.7]:12052: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 89.117.42.108
country_id: 1668284
description:
Dec  2 15:00:21 host2 pure-ftpd[1870671]: (?@89.117.42.108) [INFO] New connection from 89.117.42.108


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.243.40.140
country_id: 6252001
description:
Dec  2 15:00:46 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=104.243.40.140, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0twowPREqpJo8yiM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 204.144.187.198
country_id: 6252001
description:
Dec  2 15:01:35 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 9 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=204.144.187.198, lip=66.85.158.91, TLS, session=<NcmJwvRE7svMkLvG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.45
country_id: 6252001
description:
2025-12-02 15:02:54 dovecot_login authenticator failed for ([70.174.168.45]) [70.174.168.45]:47677: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.174.186
country_id: 6252001
description:
2025-12-02 15:02:56 dovecot_login authenticator failed for (WIN-T54PTGSAAGM) [70.174.174.186]:48168: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-02 15:03:28 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:39826: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-02 15:04:25 dovecot_plain authenticator failed for (bulacet) [109.226.27.227]:56313: 535 Incorrect authentication data (set_id=office@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.93
country_id: 130758
description:
Dec  2 15:13:37 host2 sshd[1882680]: User agentallianz from 62.60.135.93 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-02 15:15:18 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53747: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-02 15:20:04 dovecot_login authenticator failed for ([127.0.0.1]) [62.97.161.172]:47575: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-02 15:20:11 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.122.247]:49750: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  2 15:23:05 host2 sshd[1894525]: Disconnected from invalid user corina 62.60.131.157 port 24634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-02 15:23:38 dovecot_login authenticator failed for ([105.73.196.19]) [196.216.81.126]:54308: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 15:24:10 host2 sshd[1896089]: Disconnected from invalid user admin 2.57.121.112 port 22923 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-02 15:23:27 dovecot_login authenticator failed for ([218.87.21.146]) [103.107.36.18]:58076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.175
country_id: 6252001
description:
2025-12-02 15:26:46 dovecot_login authenticator failed for (ADMIN) [212.32.50.175]:35812: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  2 15:26:17 host2 sshd[1898801]: User agentallianz from 62.60.135.107 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 15:37:17 host2 sshd[1910518]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-02 15:38:13 dovecot_login authenticator failed for ([218.58.73.238]) [172.248.47.114]:51205: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.0.193
country_id: 1819730
description:
Dec  2 15:38:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.0.193, lip=66.85.158.91, session=<arMsRvVE5gmlmgDB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-12-02 15:38:51 dovecot_login authenticator failed for ([195.222.57.190]) [182.239.80.71]:42770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.34
country_id: 1819730
description:
Dec  2 15:39:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.34, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pTdbSfVEEp0tjpoi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec  2 15:41:56 host2 sshd[1914367]: Disconnected from invalid user cesar 150.5.169.138 port 56368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  2 15:42:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<zdyvVPVEdhxChJl7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Dec  2 15:43:17 host2 sshd[1915352]: Disconnected from invalid user ghost 150.5.169.138 port 33362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec  2 15:44:39 host2 sshd[1916541]: Disconnected from invalid user lab 150.5.169.138 port 34120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec  2 15:47:07 host2 sshd[1918785]: Disconnected from invalid user user 150.5.169.138 port 50004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.164.242
country_id: 6252001
description:
2025-12-02 15:47:36 dovecot_login authenticator failed for (ADMIN) [181.214.164.242]:4661: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-02 15:50:45 dovecot_plain authenticator failed for (chydel) [12.150.243.22]:25286: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.154
country_id: 690791
description:
Dec  2 15:52:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.44.78.154, lip=66.85.158.91, TLS, session=<A4Iwd/VEaJXCLE6a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.247.76.154
country_id: 3865483
description:
Dec  2 15:52:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=170.247.76.154, lip=66.85.158.91, TLS, session=<z39iePVEMLqq90ya>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-02 16:05:33 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:43178: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-02 16:06:05 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:29517: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.12
country_id: 1522867
description:
2025-12-02 16:08:51 dovecot_login authenticator failed for (ADMIN) [62.133.47.12]:55662: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-02 16:09:33 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com ([49.124.133.103]) [34.84.162.177]:51252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  2 16:09:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<V9xDtvVEEtdRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-12-02 16:12:26 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net (221-120-4-37.emome-ip.hinet.net) [75.64.207.52]:37762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-02 16:13:06 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:40323: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-12-02 16:13:15 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:50638: 535 Incorrect authentication data (set_id=dev@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-02 16:13:26 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:39704: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-02 16:13:37 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:56896: 535 Incorrect authentication data (set_id=dev)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-02 16:22:06 dovecot_login authenticator failed for ([31.173.67.141]) [103.50.5.94]:37973: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.103.27
country_id: 798544
description:
Dec  2 16:24:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.219.103.27, lip=66.85.158.91, TLS, session=<F5+76/VE5Iay22cb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.94.203.35
country_id: 3469034
description:
Dec  2 16:25:20 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.94.203.35, lip=66.85.158.91, TLS, session=<pDV67fVEOpSKXssj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-02 16:27:30 dovecot_login authenticator failed for ([127.0.0.1]) [78.156.0.88]:48023: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.251
country_id: 3996063
description:
2025-12-02 16:27:42 dovecot_login authenticator failed for ([127.0.0.1]) [201.173.216.251]:44872: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-02 16:28:44 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (inaburs) [71.62.34.216]:35918: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  2 16:29:13 host2 sshd[1947880]: Disconnected from invalid user corina 62.60.131.157 port 43485 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Dec  2 16:30:16 host2 sshd[1948584]: Disconnected from invalid user msf 185.141.132.26 port 57288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.20
country_id: 2993457
description:
2025-12-02 16:30:39 dovecot_login authenticator failed for (ADMIN) [95.181.233.20]:47187: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 16:31:38 host2 sshd[1949277]: Disconnected from invalid user user 2.57.121.25 port 8854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-02 16:32:22 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:53757: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-02 16:32:23 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (drilly) [68.52.119.193]:54792: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-02 16:32:26 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (biliat) [71.229.43.123]:56162: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-02 16:32:52 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:45898: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  2 16:34:17 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.106, lip=66.85.158.91, session=</AiaDvZE9II+PIdq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec  2 16:33:30 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OhXGC/ZECppChJlw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec  2 16:34:54 host2 sshd[1950979]: Disconnected from invalid user g 205.185.115.224 port 50498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.141.132.26
country_id: 130758
description:
Dec  2 16:35:38 host2 sshd[1951578]: Disconnected from invalid user g 185.141.132.26 port 45306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec  2 16:36:06 host2 sshd[1951927]: Disconnected from invalid user toor 205.185.115.224 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Dec  2 16:37:17 host2 sshd[1952516]: Disconnected from invalid user user 205.185.115.224 port 44286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-02 16:38:08 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (ablenast) [98.222.93.199]:51194: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Dec  2 16:39:31 host2 sshd[1953807]: Disconnected from invalid user bitnami 205.185.115.224 port 38074 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 16:41:01 host2 sshd[1954746]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 16:41:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<xFZwJ/ZEys0XXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:42:38 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<DHN2LPZEMuwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:43:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<e/UZMPZE/NIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:44:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jdtqMvZEwK4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  2 16:45:46 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<sGOfN/ZEzvdChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:46:00 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<bUmBOPZEfosDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.23.82
country_id: 2921044
description:
Dec  2 16:48:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.223.23.82, lip=66.85.158.91, session=<q4ZdQPZEQ/Gf3xdS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.114.136
country_id: 2921044
description:
Dec  2 16:48:13 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.114.136, lip=66.85.158.91, session=<nN5sQPZEmo4uZXKI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:48:44 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<evg6QvZEJqUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:49:20 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<mF9nRPZEst4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec  2 16:50:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<mfjXSPZEDJMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.10
country_id: 2589581
description:
2025-12-02 16:51:09 dovecot_login authenticator failed for (ADMIN) [176.125.228.10]:5097: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  2 17:06:51 host2 sshd[1971928]: Disconnected from invalid user cristobal 62.60.131.157 port 39279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-02 17:06:53 dovecot_plain authenticator failed for (nition) [91.73.188.251]:51027: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-02 17:06:56 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (stomak) [196.47.172.253]:35831: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 17:09:07 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 17:09:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<BRgdjvZEAOgXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.201
country_id: 3175395
description:
2025-12-02 17:11:18 dovecot_login authenticator failed for (ADMIN) [156.146.41.201]:46664: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2025-12-02 17:23:19 dovecot_login authenticator failed for ([128.185.70.193]) [125.19.157.158]:34282: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-12-02 17:24:14 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:60287: 535 Incorrect authentication data (set_id=help)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-02 17:26:01 dovecot_plain authenticator failed for (conoll) [187.161.198.68]:50850: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.160
country_id: 6252001
description:
2025-12-02 17:28:50 dovecot_login authenticator failed for (ADMIN) [181.214.165.160]:61208: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-02 17:32:40 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (conei) [81.225.30.107]:50365: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.126
country_id: 6252001
description:
Dec  2 17:32:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.126, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aqE24PZEm9TDuEx+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.99
country_id: 6252001
description:
Dec  2 17:33:04 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.99, lip=66.85.158.92, TLS: Connection closed, session=<pV3T4PZES5LDuExj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  2 17:32:12 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, session=<rzS43fZEuMZHBpK6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  2 17:32:15 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, session=<Y+no3fZElstHBpK6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.98
country_id: 6252001
description:
Dec  2 17:33:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.98, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EUxm4fZEMbzDuExi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.100
country_id: 6252001
description:
Dec  2 17:33:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.100, lip=66.85.158.92, TLS: Connection closed, session=<RBGV4fZES9bDuExk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-02 17:34:25 dovecot_login authenticator failed for ([127.0.0.1]) [187.161.136.37]:35055: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.173.246
country_id: 6252001
description:
2025-12-02 17:34:32 dovecot_login authenticator failed for ([127.0.0.1]) [70.174.173.246]:49731: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 17:35:40 host2 sshd[1991050]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 17:36:30 host2 sshd[1991415]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-02 17:36:14 dovecot_plain authenticator failed for (ghara) [102.53.15.17]:40122: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.12.58
country_id: 6251999
description:
Dec  2 17:41:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.203.12.58, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3weh//ZEqrmfyww6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.35
country_id: 953987
description:
Dec  2 17:43:36 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.40.35, lip=66.85.158.91, TLS, session=<fYBSBfdEJ+tmQCgj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.218
country_id: 690791
description:
Dec  2 17:43:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@systemtec.lk>, method=PLAIN, rip=176.103.4.218, lip=66.85.158.91, TLS, session=<9X7vA/dElrawZwTa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 17:49:59 host2 sshd[2000490]: Disconnected from invalid user user 2.57.121.25 port 20541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.50
country_id: 6252001
description:
2025-12-02 17:50:02 dovecot_login authenticator failed for (ADMIN) [191.96.37.50]:37178: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-02 17:51:44 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (tegelly) [76.16.7.82]:56595: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 17:52:39 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.104, lip=66.85.158.91, session=<wwHWJvdEpsg+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.139
country_id: 298795
description:
Dec  2 17:53:01 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=149.34.211.139, lip=66.85.158.91, TLS, session=<FYklJ/dEqISVItOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.167
country_id: 3175395
description:
Dec  2 17:53:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=185.15.171.167, lip=66.85.158.91, TLS, session=<SqlPKPdEhau5D6un>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-02 17:56:56 dovecot_plain authenticator failed for (warecal) [103.51.26.198]:43172: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-02 17:58:54 dovecot_plain authenticator failed for (kidebric) [23.30.11.253]:41552: 535 Incorrect authentication data (set_id=alert@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.170
country_id: 2635167
description:
Dec  2 18:01:01 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.170, lip=66.85.158.92, TLS, session=<LynHRPdEp95X7LCq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Dec  2 18:01:34 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<Rlu+RfdEo6wu4yfe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.139
country_id: 2395170
description:
Dec  2 18:01:16 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=154.127.36.139, lip=66.85.158.91, TLS, session=<16SfRPdEmaqafySL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-02 18:01:28 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (gasts) [73.0.191.33]:40882: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-02 18:02:39 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com ([49.125.201.72]) [34.29.104.32]:45104: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec  2 18:06:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<iiLsWPdExtojygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-02 18:07:00 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:57674: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-02 18:07:22 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:42616: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.96
country_id: 1668284
description:
2025-12-02 18:08:57 dovecot_login authenticator failed for (ADMIN) [173.244.49.96]:20434: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  2 18:12:21 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, session=<ILJFbfdEINlHBpK6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Dec  2 18:12:24 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, session=<0B10bfdEauFHBpK6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-02 18:15:00 dovecot_login authenticator failed for (connect.velocitymedical.com) [36.50.167.81]:43740: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-02 18:15:33 dovecot_login authenticator failed for ([112.232.252.106]) [209.23.72.144]:38484: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.185
country_id: 3017382
description:
Dec  2 18:20:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.185, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZVD5i/dEPZ9bxJi5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.221
country_id: 3017382
description:
Dec  2 18:21:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.221, lip=66.85.158.92, TLS: Connection closed, session=<7hGZjPdEJ7xbxJjd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.222
country_id: 3017382
description:
Dec  2 18:21:21 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.222, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jQd9jfdEYd5bxJje>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Dec  2 18:26:57 host2 sshd[2030579]: Disconnected from invalid user desliga 168.194.164.218 port 56990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Dec  2 18:29:50 host2 sshd[2032697]: Disconnected from invalid user webuser 168.194.164.218 port 39683 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-02 18:29:59 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:60152: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-12-02 18:30:00 dovecot_login authenticator failed for (1522312565.colombiatel.co) [182.79.127.86]:44624: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-02 18:29:39 dovecot_login authenticator failed for ([128.185.217.150]) [107.85.14.208]:48332: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 18:29:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JtFIq/dE2pkXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.194.164.218
country_id: 3469034
description:
Dec  2 18:32:27 host2 sshd[2034311]: Disconnected from invalid user dd 168.194.164.218 port 49000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-02 18:33:29 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:45898: 535 Incorrect authentication data (set_id=hostmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-02 18:33:44 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:57520: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Dec  2 18:37:45 host2 sshd[2037729]: Disconnected from invalid user sales1 168.194.164.218 port 39416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Dec  2 18:37:59 host2 sshd[2037902]: Disconnected from invalid user user2 182.253.156.173 port 32994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  2 18:38:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.60.135.107, lip=66.85.158.91, session=<cHoSyvdEYNA+PIdr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 18:39:57 host2 sshd[2039172]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.173
country_id: 1643084
description:
Dec  2 18:39:29 host2 sshd[2038883]: Disconnected from invalid user myuser 182.253.156.173 port 54520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 18:39:30 host2 sshd[2038894]: Disconnected from invalid user user 2.57.121.25 port 10189 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Dec  2 18:40:30 host2 sshd[2039711]: Disconnected from invalid user system 168.194.164.218 port 50040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Dec  2 18:40:59 host2 sshd[2039981]: Disconnected from invalid user blue 182.253.156.173 port 38766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.173
country_id: 1643084
description:
Dec  2 18:43:48 host2 sshd[2041988]: Disconnected from invalid user stperez 182.253.156.173 port 52842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-02 18:43:50 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:49818: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-02 18:44:07 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:56162: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-02 18:44:52 dovecot_plain authenticator failed for (synalimpan) [91.73.188.251]:42185: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-02 18:45:39 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg ([38.159.46.35]) [46.10.56.170]:53506: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-12-02 18:46:09 dovecot_login authenticator failed for ([49.124.142.131]) [103.144.37.102]:32771: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-02 18:46:19 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (cunmens) [98.40.101.10]:56602: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 18:48:16 host2 sshd[2045057]: Disconnected from invalid user  2.57.121.112 port 64099 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-02 18:54:31 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (sacrost) [24.1.200.187]:57662: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-02 18:54:36 dovecot_plain authenticator failed for (irism) [65.20.133.4]:50982: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-02 18:54:39 dovecot_plain authenticator failed for (collikeron) [192.81.229.181]:60352: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2025-12-02 18:54:38 dovecot_login authenticator failed for (ADMIN) [143.244.52.64]:27248: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.69.42.134
country_id: 6252001
description:
Dec  2 18:56:06 host2 sshd[2051404]: Disconnecting authenticating user root 66.69.42.134 port 35252: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.69.42.134
country_id: 6252001
description:
Dec  2 18:56:06 host2 sshd[2051404]: error: maximum authentication attempts exceeded for root from 66.69.42.134 port 35252 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-02 18:56:15 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (puperon) [67.173.58.47]:50856: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.69.42.134
country_id: 6252001
description:
Dec  2 18:56:10 host2 sshd[2051494]: Disconnecting authenticating user root 66.69.42.134 port 36290: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.69.42.134
country_id: 6252001
description:
Dec  2 18:56:10 host2 sshd[2051494]: error: maximum authentication attempts exceeded for root from 66.69.42.134 port 36290 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 18:58:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cNfKEPhESIQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-02 19:02:28 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (mentatic) [50.74.136.134]:58444: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.220.118.201
country_id: 6290252
description:
2025-12-02 19:06:00 dovecot_plain authenticator failed for 178-220-118-201.static.isp.telekom.rs (eltenonati) [178.220.118.201]:54785: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 19:10:38 +0530] info [cpaneld] 43.245.222.27 - ceylon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-02 19:11:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57963: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 19:13:31 host2 sshd[2063144]: Disconnected from invalid user admin 2.57.121.112 port 30260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Dec  2 19:13:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5wWzSfhEXB1APpxC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-02 19:13:59 dovecot_plain authenticator failed for (unbromped) [149.62.239.4]:56822: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-02 19:14:01 dovecot_plain authenticator failed for (coppylless) [64.72.74.162]:51419: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Dec  2 19:14:16 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4xa6SvhEmNJAPpxC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-02 19:16:51 dovecot_login authenticator failed for ([103.115.252.60]) [124.246.114.111]:57501: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-02 19:17:08 dovecot_login authenticator failed for (static.vnpt.vn) [185.246.255.183]:33776: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.99
country_id: 3703430
description:
2025-12-02 19:17:52 dovecot_login authenticator failed for (ADMIN) [91.90.126.99]:54126: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-02 19:19:27 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (restred) [67.172.54.29]:50544: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 19:20:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.104, lip=66.85.158.91, session=<mSiUYvhEeLI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.40.13
country_id: 1269750
description:
2025-12-02 19:21:55 dovecot_plain authenticator failed for (Q171B58071) [49.43.40.13]:55021: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  2 19:29:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<H5g+gPhEVDlRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-02 19:36:54 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (indesynce) [69.123.219.82]:47320: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.15
country_id: 2264397
description:
2025-12-02 19:38:08 dovecot_login authenticator failed for (ADMIN) [146.70.59.15]:40664: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.47.25
country_id: 1269750
description:
2025-12-02 19:42:34 dovecot_plain authenticator failed for (5HJ30XO6291) [152.59.47.25]:63647: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-02 19:42:52 dovecot_plain authenticator failed for (miters) [65.20.153.146]:46465: 535 Incorrect authentication data (set_id=alert@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  2 19:42:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<aeMwsfhEDr2LonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.246.151
country_id: 6252001
description:
Dec  2 19:43:46 host2 sshd[2083159]: Disconnected from invalid user superadmin 74.249.246.151 port 40738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-02 19:44:36 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:52073: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-02 19:44:50 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:37904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Dec  2 19:45:05 host2 sshd[2084150]: Disconnected from invalid user user1 74.249.246.151 port 59106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-02 19:46:56 dovecot_login authenticator failed for ([127.0.0.1]) [84.210.149.45]:60730: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-02 19:47:03 dovecot_login authenticator failed for ([127.0.0.1]) [201.173.92.217]:46729: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.246.151
country_id: 6252001
description:
Dec  2 19:47:39 host2 sshd[2086576]: Disconnected from invalid user smart 74.249.246.151 port 54908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-02 19:52:12 dovecot_plain authenticator failed for (eating) [65.20.160.107]:41878: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 19:57:20 host2 sshd[2094699]: Disconnected from invalid user user 2.57.121.25 port 13731 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.183.28
country_id: 357994
description:
2025-12-02 19:57:57 dovecot_plain authenticator failed for (trove) [41.33.183.28]:41731: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.23
country_id: 298795
description:
2025-12-02 19:58:37 dovecot_login authenticator failed for (ADMIN) [188.213.34.23]:20719: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.99.71
country_id: 2921044
description:
Dec  2 19:58:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=142.93.99.71, lip=66.85.158.91, session=<X4JS6fhEqSaOXWNH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.234
country_id: 2921044
description:
Dec  2 19:58:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.91.234, lip=66.85.158.91, session=<J8pf6fhEssuGelvq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.166.120.143
country_id: 2750405
description:
Dec  2 20:02:02 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.166.120.143, lip=66.85.158.91, TLS, session=<by2U9fhEXsa8pniP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-02 20:03:47 dovecot_plain authenticator failed for (mochies) [65.20.148.165]:45904: 535 Incorrect authentication data (set_id=alert@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.151
country_id: 1269750
description:
Dec  2 20:12:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.58.65.151, lip=66.85.158.91, TLS, session=<AUDhGPlEtNtnOkGX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.21
country_id: 2300660
description:
Dec  2 20:12:36 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.18.21, lip=66.85.158.91, TLS, session=<rFsiGvlE7ucpixIV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 20:16:14 host2 sshd[2106726]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.113.192.187
country_id: 1210997
description:
2025-12-02 20:16:19 dovecot_plain authenticator failed for (LE7AQH53ZALJ4) [103.113.192.187]:55519: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 89.249.55.106 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.39.65
country_id: 1210997
description:
2025-12-02 20:19:56 dovecot_plain authenticator failed for (UJZECE2W) [103.59.39.65]:54969: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.66
country_id: 2635167
description:
Dec  2 20:19:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.66, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<n1ysNflEd8cjy9JC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.66
country_id: 2635167
description:
Dec  2 20:20:44 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.210.66, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<e4tnOPlEyP0jy9JC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.62
country_id: 2661886
description:
2025-12-02 20:21:21 dovecot_login authenticator failed for (ADMIN) [46.246.8.62]:20539: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.22
country_id: 6252001
description:
2025-12-02 20:26:35 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.120.22]:35052: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-02 20:26:49 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.58.62]:45122: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.2.62
country_id: 953987
description:
Dec  2 20:28:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.66.2.62, lip=66.85.158.91, TLS, session=<bEqWUflEENRmQgI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.66
country_id: 2635167
description:
Dec  2 20:28:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.66, lip=66.85.158.91, TLS, session=<gAvKU/lE1O4jy9JC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.141.249.96
country_id: 3469034
description:
Dec  2 20:28:26 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=192.141.249.96, lip=66.85.158.91, TLS, session=<jxDwUvlEKJvAjflg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Dec  2 20:37:17 host2 sshd[2119638]: Disconnected from invalid user user 43.133.254.75 port 56732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec  2 20:38:26 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<qBG0d/lEEma4aYtF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.254.75
country_id: 1835841
description:
Dec  2 20:38:51 host2 sshd[2120489]: Disconnected from invalid user ubuntu 43.133.254.75 port 58362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.196
country_id: 1733045
description:
Dec  2 20:40:06 host2 sshd[2121620]: Disconnected from invalid user ir 202.165.17.196 port 38204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.42
country_id: 798544
description:
Dec  2 20:40:32 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.184.82.42, lip=66.85.158.91, TLS, session=<dFk9fvlEJ4bDuFIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.94.162.44
country_id: 3469034
description:
Dec  2 20:40:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=138.94.162.44, lip=66.85.158.91, TLS, session=<8Sxlf/lEJeuKXqIs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Dec  2 20:40:29 host2 sshd[2121948]: Disconnected from invalid user superset 43.133.254.75 port 59998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.254.75
country_id: 1835841
description:
Dec  2 20:42:05 host2 sshd[2122878]: Disconnected from invalid user oracle 43.133.254.75 port 33396 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  2 20:44:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<o6eui/lE7sWSOC+J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.17.196
country_id: 1733045
description:
Dec  2 20:43:56 host2 sshd[2123927]: Disconnected from invalid user superset 202.165.17.196 port 38008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-02 20:45:23 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:47244: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  2 20:47:25 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<gi6ol/lECcEvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec  2 20:47:31 host2 sshd[2126905]: Disconnected from invalid user teamspeak 192.210.233.234 port 46150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec  2 20:48:36 host2 sshd[2127554]: Disconnected from invalid user intell 192.210.233.234 port 38094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec  2 20:50:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wuTmovlEljojupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec  2 20:50:46 host2 sshd[2129077]: Disconnected from invalid user gg 192.210.233.234 port 42600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-02 20:51:08 dovecot_login authenticator failed for ([24.196.148.169]) [24.196.148.169]:62138: 535 Incorrect authentication data (set_id=office@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-02 20:51:23 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:14500: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec  2 20:51:45 host2 sshd[2129608]: Disconnected from invalid user testuser 192.210.233.234 port 55368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.131.233.52
country_id: 3469034
description:
Dec  2 20:54:27 host2 sshd[2131318]: Disconnected from invalid user halo 137.131.233.52 port 59428 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.220
country_id: 2635167
description:
Dec  2 20:55:41 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.220, lip=66.85.158.91, TLS, session=<vVJvtflEubS594nc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.127
country_id: 6252001
description:
2025-12-02 20:56:44 dovecot_login authenticator failed for wsip-184-191-250-127.fv.ks.cox.net ([127.0.0.1]) [184.191.250.127]:47830: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 20:57:00 host2 sshd[2133668]: Disconnected from invalid user admin 2.57.121.112 port 9167 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2025-12-02 20:57:02 dovecot_login authenticator failed for ([127.0.0.1]) [125.19.159.186]:38616: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec  2 20:56:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<sojwt/lE4C7Y2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.234
country_id: 6252001
description:
Dec  2 20:57:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.234, lip=66.85.158.92, session=<gGoMvPlEusZHBobq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.131.233.52
country_id: 3469034
description:
Dec  2 20:58:25 host2 sshd[2134573]: Disconnected from invalid user gg 137.131.233.52 port 53746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.131.233.52
country_id: 3469034
description:
Dec  2 21:00:31 host2 sshd[2136203]: Disconnected from invalid user admin123 137.131.233.52 port 35798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.179
country_id: 6252001
description:
Dec  2 21:01:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=147.185.132.179, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PuoiyflEQteTuYSz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.179
country_id: 6252001
description:
Dec  2 21:02:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 26 secs): user=<>, rip=147.185.132.179, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zz3fzflEcuOTuYSz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.156.66.93
country_id: 617790
description:
Dec  2 21:03:45 host2 sshd[2138673]: Disconnected from invalid user azureuser 217.156.66.93 port 48502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.128
country_id: 2921044
description:
2025-12-02 21:05:47 dovecot_login authenticator failed for (ADMIN) [191.101.157.128]:59716: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.156.66.93
country_id: 617790
description:
Dec  2 21:06:08 host2 sshd[2140223]: Disconnected from invalid user devuser 217.156.66.93 port 50180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.131.233.52
country_id: 3469034
description:
Dec  2 21:06:48 host2 sshd[2140567]: Disconnected from invalid user zmarin 137.131.233.52 port 58484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 217.156.66.93
country_id: 617790
description:
Dec  2 21:07:35 host2 sshd[2141020]: Disconnected from invalid user opc 217.156.66.93 port 36652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.41.141
country_id: 2921044
description:
Dec  2 21:08:46 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.211.41.141, lip=66.85.158.92, session=<LdY15PlExtUI0ymN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.156.66.93
country_id: 617790
description:
Dec  2 21:08:59 host2 sshd[2141708]: Disconnected from invalid user test 217.156.66.93 port 40836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.179
country_id: 6252001
description:
Dec  2 21:10:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.179, lip=66.85.158.92, TLS, session=<5FYg6flEsPCTuYSz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.156.66.93
country_id: 617790
description:
Dec  2 21:10:24 host2 sshd[2142720]: Disconnected from invalid user github 217.156.66.93 port 60748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.179
country_id: 6252001
description:
Dec  2 21:10:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.179, lip=66.85.158.92, TLS, session=<41HE6vlEYPyTuYSz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 21:11:34 host2 sshd[2143348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec  2 21:13:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3orH8/lEkmwjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 21:14:00 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<STHF9vlEUMI+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 21:14:38 host2 sshd[2145548]: Disconnected from invalid user user 2.57.121.25 port 54117 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.131.233.52
country_id: 3469034
description:
Dec  2 21:17:13 host2 sshd[2147282]: Disconnected from invalid user testadmin 137.131.233.52 port 57774 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 21:19:53 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 21:21:10 host2 sshd[2150035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  2 21:21:55 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<wpQWE/pEzrU+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-02 21:23:16 dovecot_plain authenticator failed for (leling) [23.30.11.253]:48840: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.92
country_id: 6252001
description:
Dec  2 21:24:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.92, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XKkDHPpEpO1iUARc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.184
country_id: 6252001
description:
Dec  2 21:26:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.184, lip=66.85.158.92, session=<N+ZZI/pEGs4s3Lm4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.33
country_id: 2542007
description:
2025-12-02 21:27:01 dovecot_login authenticator failed for (ADMIN) [95.181.232.33]:32803: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec  2 21:27:01 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3SZzJfpELlBAPpwY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec  2 21:27:19 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+c6RJvpEMBxAPpwY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.32
country_id: 6252001
description:
2025-12-02 21:27:45 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.46.32]:53572: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.221.222.53
country_id: 953987
description:
2025-12-02 21:27:54 dovecot_login authenticator failed for ([127.0.0.1]) [45.221.222.53]:37376: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-02 21:29:25 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (mying) [73.145.107.251]:40492: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 21:36:41 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<p7TUR/pE1IQ+PIdo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.165
country_id: 2635167
description:
Dec  2 21:40:22 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.165, lip=66.85.158.92, TLS, session=<x+A7VfpEKZ5X7LCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.165
country_id: 2635167
description:
Dec  2 21:40:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.165, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<GHtFVfpE/ba594ml>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.167
country_id: 2635167
description:
Dec  2 21:40:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.167, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ydBAV/pENYa594mn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.156
country_id: 2635167
description:
Dec  2 21:41:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.156, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<9FI8WfpENYG594mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.178
country_id: 2635167
description:
Dec  2 21:42:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.178, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<PZo3W/pEC55X7LCy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.162
country_id: 2635167
description:
Dec  2 21:43:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qFIsX/pEC7+594mi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.161
country_id: 2635167
description:
Dec  2 21:42:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.161, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<s/YyXfpEPYVX7LCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.154
country_id: 2635167
description:
Dec  2 21:43:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.154, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<4LcpYfpEZdG594ma>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.169
country_id: 2635167
description:
Dec  2 21:44:49 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.169, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<j3EeZfpEp7ZX7LCp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.152
country_id: 2635167
description:
Dec  2 21:44:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.152, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<xw0lY/pE262594mY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  2 21:44:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<QlPzY/pEQJM+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.54
country_id: 597427
description:
2025-12-02 21:44:48 dovecot_login authenticator failed for (ADMIN) [194.32.122.54]:49934: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.174
country_id: 2635167
description:
Dec  2 21:45:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<s8YZZ/pE3c5X7LCu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  2 21:52:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<kEZqgPpEwXQvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.4
country_id: 1733045
description:
2025-12-02 21:59:59 dovecot_login authenticator failed for ([49.124.132.4]) [49.124.132.4]:45922: 535 Incorrect authentication data (set_id=operator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.74
country_id: 2510769
description:
2025-12-02 22:03:17 dovecot_login authenticator failed for (ADMIN) [212.102.49.74]:53441: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.8.46
country_id: 2300660
description:
Dec  2 22:08:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=41.139.8.46, lip=66.85.158.91, TLS, session=<C3mEufpE9sEpiwgu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.234
country_id: 3865483
description:
Dec  2 22:09:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.64.95.234, lip=66.85.158.91, TLS, session=<V9fKuvpEmr26QF/q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 22:12:11 host2 sshd[2204286]: Disconnected from invalid user admin 2.57.121.112 port 6274 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 22:16:03 host2 sshd[2207188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.178.134.122
country_id: 6252001
description:
Dec  2 22:17:02 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (auth failed, 2 attempts in 8 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=161.178.134.122, lip=66.85.158.91, TLS, session=<5rDa1/pELc2hsoZ6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.49
country_id: 2635167
description:
Dec  2 22:17:13 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.49, lip=66.85.158.92, TLS, session=<wuEA2fpEIZW594kx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.178.134.122
country_id: 6252001
description:
Dec  2 22:16:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=161.178.134.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<la3X1/pEK82hsoZ6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-02 22:23:03 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:44033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-02 22:23:29 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:46012: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.39
country_id: 3469034
description:
2025-12-02 22:24:05 dovecot_login authenticator failed for (ADMIN) [146.70.98.39]:65253: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.203.196.74
country_id: 6252001
description:
Dec  2 22:24:42 host2 pure-ftpd[2213465]: (?@44.203.196.74) [INFO] New connection from 44.203.196.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-02 22:25:55 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (trifuse) [76.145.10.140]:45522: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 22:31:24 host2 sshd[2218378]: Disconnected from invalid user user 2.57.121.25 port 24116 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.175
country_id: 2635167
description:
Dec  2 22:31:08 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.175, lip=66.85.158.91, TLS, session=<QfPBCvtEbcu594mv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.204
country_id: 2635167
description:
Dec  2 22:31:09 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.204, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<RGHPCvtEp7K594nM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Dec  2 22:31:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0r7KDPtE2dJX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.191
country_id: 2635167
description:
Dec  2 22:32:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.191, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lSLGDvtEJ45X7LC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.197
country_id: 2635167
description:
Dec  2 22:33:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.197, lip=66.85.158.91, TLS handshaking: Connection closed, session=<97y8EvtEBYpX7LDF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.185
country_id: 2635167
description:
Dec  2 22:32:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.185, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<qXHBEPtEB4e594m5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.201
country_id: 2635167
description:
Dec  2 22:33:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xTu2FPtEn6JX7LDJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.200
country_id: 2635167
description:
Dec  2 22:34:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.200, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<So6zFvtEM+6594nI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec  2 22:35:01 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<FBGvGPtEs9xX7LDV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.155
country_id: 3865483
description:
Dec  2 22:35:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=45.238.106.155, lip=66.85.158.91, TLS, session=<YCSLGPtES78t7mqb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.129.60.204
country_id: 953987
description:
Dec  2 22:35:30 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=102.129.60.204, lip=66.85.158.91, session=<9wVjGvtElr9mgTzM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.205
country_id: 2635167
description:
Dec  2 22:35:34 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.205, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<xmKoGvtEL5NX7LDN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.101.23
country_id: 798544
description:
Dec  2 22:35:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.101.23, lip=66.85.158.91, TLS, session=<nuh0GvtEmbSy22UX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.193
country_id: 2635167
description:
Dec  2 22:36:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.193, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<BMGjHPtEbaBX7LDB>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.229
country_id: 6252001
description:
Dec  2 22:39:04 host2 pure-ftpd[2223132]: (?@198.235.24.229) [INFO] New connection from 198.235.24.229


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.203.232
country_id: 1269750
description:
2025-12-02 22:40:25 dovecot_plain authenticator failed for (L7V1JJ7) [106.51.203.232]:54109: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.11
country_id: 2589581
description:
2025-12-02 22:43:25 dovecot_login authenticator failed for (ADMIN) [176.125.228.11]:32210: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-02 22:45:18 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (wonopon) [73.197.236.163]:48442: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.254.165.85
country_id: 6252001
description:
Dec  2 22:44:54 host2 sshd[2226469]: Invalid user cloudtourssrilan_travel from 157.254.165.85 port 52382


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 22:48:00 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-02 22:52:14 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (oreron) [71.62.34.216]:55994: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.90.213.28
country_id: 6252001
description:
Dec  2 22:53:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<587hr>, method=PLAIN, rip=74.90.213.28, lip=66.85.158.91, session=<dOQAW/tEyrlKWtUc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.12.132.63
country_id: 294640
description:
Dec  2 22:53:03 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=176.12.132.63, lip=66.85.158.91, session=<0mb1WPtE5uywDIQ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Dec  2 22:53:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, TLS, session=<FAFAWftEarS0vP2W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  2 22:53:46 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4DqXW/tEKOvD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  2 22:53:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<h7lSXPtESK+OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.147.94
country_id: 290557
description:
Dec  2 22:54:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<587hr>, method=PLAIN, rip=80.227.147.94, lip=66.85.158.91, TLS, session=<BYljW/tES9hQ45Ne>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  2 22:57:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<wJ3KaftEZqml0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-12-02 22:59:17 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:50742: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 22:59:23 host2 sshd[2236482]: Disconnected from invalid user admin 2.57.121.112 port 48817 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  2 23:00:55 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<NsctdftEWskm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  2 23:01:04 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=</8O1dftE7tYv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec  2 23:01:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<t6lOd/tEaidChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-02 22:59:54 dovecot_login authenticator failed for ([122.187.229.194]) [122.187.229.194]:53410: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.83
country_id: 6252001
description:
Dec  2 23:04:52 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.83, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Fnxrg/tExYtAPpxT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec  2 23:05:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZiKDhPtEivBAPpxQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.22.115
country_id: 6252001
description:
2025-12-02 23:05:22 dovecot_login authenticator failed for (ADMIN) [158.173.22.115]:44384: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-02 23:06:51 dovecot_login authenticator failed for ([103.83.130.80]) [103.83.130.80]:40317: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  2 23:07:20 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZN8hjPtE5Msv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-02 23:07:36 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:61402: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-02 23:08:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49695: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  2 23:09:02 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<wPQ3kvtEeMSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  2 23:09:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<jZ8UlftE4IvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  2 23:09:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<zDx2lftEDsKiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  2 23:10:02 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<Z6bElftEpM0vWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  2 23:10:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3vZUl/tEr4Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Dec  2 23:11:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<zVQZm/tE9Opn9Sd0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec  2 23:13:56 host2 sshd[2247655]: Disconnected from invalid user foundry 203.90.110.186 port 60430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.194.2
country_id: 2921044
description:
Dec  2 23:14:46 host2 sshd[2248225]: Disconnected from invalid user teste 207.154.194.2 port 55644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  2 23:15:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<XTBOqftErIxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  2 23:15:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<yT82qvtEBq6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  2 23:16:40 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<mWB5rftEXIYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.54
country_id: 1269750
description:
Dec  2 23:18:19 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.30.81.54, lip=66.85.158.91, TLS, session=<iqNwsvtEMqpnHlE2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.194.2
country_id: 2921044
description:
Dec  2 23:18:23 host2 sshd[2250736]: Disconnected from invalid user manager 207.154.194.2 port 43748 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.73.7
country_id: 798544
description:
Dec  2 23:18:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.93.73.7, lip=66.85.158.91, TLS, session=<bP6as/tE+bu5XUkH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  2 23:17:41 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<jaQbsftE5pCB4rs4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec  2 23:19:07 host2 sshd[2251138]: Disconnected from invalid user hu 124.155.125.131 port 45558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.154.194.2
country_id: 2921044
description:
Dec  2 23:19:27 host2 sshd[2251280]: Disconnected from invalid user tidb 207.154.194.2 port 35040 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 23:19:41 host2 sshd[2251406]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  2 23:19:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<TzJRuPtENoUvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec  2 23:20:27 host2 sshd[2251949]: Disconnected from invalid user valheim 124.155.125.131 port 34212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.194.2
country_id: 2921044
description:
Dec  2 23:20:30 host2 sshd[2251963]: Disconnected from invalid user cashier 207.154.194.2 port 43936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.194.2
country_id: 2921044
description:
Dec  2 23:21:31 host2 sshd[2252576]: Disconnected from invalid user albert 207.154.194.2 port 43506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec  2 23:22:58 host2 sshd[2253445]: Disconnected from invalid user syncuser 124.155.125.131 port 51440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.155.125.131
country_id: 1861060
description:
Dec  2 23:24:09 host2 sshd[2254247]: Disconnected from invalid user tony 124.155.125.131 port 41474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.76
country_id: 3144096
description:
2025-12-02 23:23:51 dovecot_login authenticator failed for (ADMIN) [46.246.122.76]:40329: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.202.175.118
country_id: 3017382
description:
Dec  2 23:27:14 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.202.175.118, lip=66.85.158.91, session=<xDRB0/tEZM4uyq92>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Dec  2 23:30:16 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<dhQ63vtE/P7Y2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec  2 23:30:34 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<EpNY3/tESk9KUi8E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Dec  2 23:30:43 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<FXne3/tERvLY2s5F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec  2 23:30:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, TLS: Connection closed, session=<fMEp4PtEDipKUi8E>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.101.70
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 161.97.101.70 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec  2 23:36:10 host2 sshd[2261598]: Disconnected from invalid user qw 203.90.110.186 port 59740 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  2 23:37:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<C3wm+PtE5tC58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  2 23:40:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<zL0hA/xECI6OXXSy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.90.110.186
country_id: 1269750
description:
Dec  2 23:40:09 host2 sshd[2264275]: Disconnected from invalid user kapsch 203.90.110.186 port 39112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  2 23:40:26 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<FNqAAvxErKfD+hnW>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  2 23:42:25 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<KQCxCfxE1MW58uIR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  2 23:43:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<P9qjDvxEbuil0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.37
country_id: 2635167
description:
2025-12-02 23:44:35 dovecot_login authenticator failed for (ADMIN) [158.173.23.37]:27651: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  2 23:46:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<mgSuGPxEZtwm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  2 23:46:44 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<N98KGfxEZMYv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.84.164
country_id: 2017370
description:
2025-12-02 23:48:45 dovecot_login authenticator failed for ([127.0.0.1]) [93.171.84.164]:49618: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-02 23:48:54 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.63.50]:48430: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  2 23:52:17 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<s/fgLPxENoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  2 23:53:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<wB6hMfxE3pakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  2 23:54:35 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<gN4VNfxEns4vWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  2 23:54:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<OeJjM/xEHODO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  2 23:54:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<zwDiNPxEcIeiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Dec  2 23:55:34 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<DEGUOPxE9rxn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  2 23:55:00 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<P7CXNvxEKM8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  2 23:59:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<qTLMRvxE6rinYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  2 23:59:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6ugORfxEGtlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 00:00:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<JJ2ISfxEAq4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 00:01:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<zTmvTPxErMeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 00:01:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<yHueTvxEcLoXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 00:02:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<yUEBUfxEdNHANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 00:02:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<tUAbUvxERqovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 00:03:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<4gejVPxEsovD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 00:04:40 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<J2EsWfxEdNyOXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-03 00:06:20 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [103.120.116.162]:44169: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-12-03 00:06:41 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [125.19.194.166]:51300: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-03 00:10:34 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:46192: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 00:09:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<gEkRbPxEVt8m9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 00:09:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<EnEmbPxEPKcv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 00:10:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<ztaMb/xELuCl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-03 00:11:01 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:47762: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.73
country_id: 6252001
description:
2025-12-03 00:12:25 dovecot_login authenticator failed for (ADMIN) [102.129.153.73]:54196: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Dec  3 00:16:41 host2 sshd[2289382]: Disconnected from invalid user rstudio 144.48.8.10 port 40722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec  3 00:16:45 host2 sshd[2289432]: Disconnected from invalid user kali 192.3.105.24 port 33084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 00:17:01 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hyhUhfxEKOQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 00:17:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<hnl7hvxEtKM+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.148.228
country_id: 298795
description:
Dec  3 00:17:33 host2 sshd[2289873]: Disconnected from invalid user nrk 213.142.148.228 port 46158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 00:17:47 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<+C8TiPxEpMYvWGUU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Dec  3 00:17:50 host2 sshd[2290011]: Disconnected from invalid user odin 144.48.8.10 port 41474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.36.217
country_id: 3175395
description:
Dec  3 00:18:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=178.239.36.217, lip=66.85.158.91, TLS, session=<SegqivxEKq2y7yTZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 00:18:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<A3TZi/xELpSkXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.148.228
country_id: 298795
description:
Dec  3 00:19:15 host2 sshd[2290864]: Disconnected from invalid user rstudio 213.142.148.228 port 49410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 00:19:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ZPAVj/xEVIgz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec  3 00:18:57 host2 sshd[2290643]: Disconnected from invalid user nominatim 192.3.105.24 port 33316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec  3 00:18:58 host2 sshd[2290647]: Disconnected from invalid user gns3 35.237.94.18 port 47674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.180
country_id: 953987
description:
Dec  3 00:19:01 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.47.180, lip=66.85.158.91, TLS, session=<cclyi/xEechmQC+0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 00:19:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<MLVDjvxEtJmiAOAm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec  3 00:20:09 host2 sshd[2291538]: Disconnected from invalid user odin 35.237.94.18 port 49106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Dec  3 00:21:16 host2 sshd[2292316]: Disconnected from invalid user cds 35.237.94.18 port 50540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Dec  3 00:21:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<Ggp/lPxEgpRn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 00:21:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Rju2lfxEMOXO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-03 00:22:19 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:39382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Dec  3 00:22:25 host2 sshd[2293048]: Disconnected from invalid user usuario1 35.237.94.18 port 51970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-03 00:22:28 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:49443: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 00:22:00 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<euMml/xE0tI+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.148.228
country_id: 298795
description:
Dec  3 00:23:56 host2 sshd[2293768]: Disconnected from invalid user huawei 213.142.148.228 port 50724 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 00:25:04 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<3XUbovxEBEKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 00:25:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<t8zzovxERM9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.148.228
country_id: 298795
description:
Dec  3 00:25:31 host2 sshd[2295028]: Disconnected from invalid user super 213.142.148.228 port 33924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 00:26:26 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<irsDp/xE8sXD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 00:27:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<odxoqfxERK4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 00:27:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vb63qvxEZqQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 00:28:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<2sWArfxEwKuB4rs4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.147
country_id: 1880251
description:
Dec  3 00:29:28 host2 sshd[2297301]: Disconnected from invalid user gerrit 101.47.48.147 port 47528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 00:29:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<++hBsfxEYr2OXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-03 00:29:26 dovecot_login authenticator failed for (2-55-68-141.orange.net.il) [121.73.169.153]:56222: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-12-03 00:29:59 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com ([59.20.85.112]) [202.82.20.241]:61295: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.225
country_id: 6252001
description:
Dec  3 00:31:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.225, lip=66.85.158.92, TLS: Connection closed, session=<PgM6ufxEkcfDuEzh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.14
country_id: 2029969
description:
2025-12-03 00:31:38 dovecot_login authenticator failed for (ADMIN) [173.244.58.14]:50944: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 00:31:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<I6Wmt/xEHoXANXk9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.4
country_id: 6252001
description:
Dec  3 00:31:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=195.184.76.4, lip=66.85.158.92, TLS handshaking: Connection closed, session=<64IQuPxE7crDuEwE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Dec  3 00:31:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, TLS: Connection closed, session=<cSu6uPxEt+DDuEzj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.6
country_id: 6252001
description:
Dec  3 00:31:27 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.6, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<H0MLufxEVefDuEwG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.147
country_id: 1880251
description:
Dec  3 00:32:03 host2 sshd[2299225]: Disconnected from invalid user autcom 101.47.48.147 port 58088 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 00:32:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<J7D5vPxEkLMvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 00:33:19 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<ynubv/xE5uIv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 00:33:33 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<X1l1wPxE7OEm9w7I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.147
country_id: 1880251
description:
Dec  3 00:34:32 host2 sshd[2300840]: Disconnected from invalid user foundry 101.47.48.147 port 56060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 00:38:20 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<RCSI0fxETIml0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-03 00:40:26 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br ([114.101.79.13]) [179.125.169.77]:51988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.12.160.212
country_id: 3175395
description:
2025-12-03 00:41:02 dovecot_login authenticator failed for host-87-12-160-212.business.telecomitalia.it ([182.135.122.79]) [87.12.160.212]:48220: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 00:41:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<3RJI2/xEGr8vWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 00:41:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<IV3v3fxEoqQv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.111.144
country_id: 2921044
description:
Dec  3 00:42:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.111.144, lip=66.85.158.92, session=<k5EP3/xEgcJA4m+Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 00:43:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<FzSI5fxEWKM+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 00:44:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<PM6e6PxEiKOiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  3 00:44:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Vy585vxERqo+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 00:44:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<wJa35vxE1qakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 00:44:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<MYEm6PxECLAz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 00:45:25 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:59334: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.245.39.116
country_id: 1643084
description:
Dec  3 00:47:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=103.245.39.116, lip=66.85.158.91, session=<buS88fxEZphn9Sd0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 00:48:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<MQZ09fxETJTO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 00:49:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<EFIh+vxE8N7D+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 00:50:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ITqV/fxEGJanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 00:51:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VXCCAf1EtuVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.56
country_id: 3017382
description:
2025-12-03 00:53:41 dovecot_login authenticator failed for (ADMIN) [191.101.31.56]:16025: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 00:53:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<H3lwCf1ENLGOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 00:54:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<XEZZCv1EoNgrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 00:55:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<Uu2WD/1EcoWB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 00:56:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<8sYDFP1E6Ocv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 00:57:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<5ctTFf1E0OMm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 01:02:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<6ICAKP1EgrkvWbHj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 01:03:31 host2 sshd[2323603]: Disconnected from invalid user user 2.57.121.25 port 38488 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 01:04:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<Ad1BL/1ETLcvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 01:05:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<I9bpM/1EbKWl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 01:06:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<tb2sN/1E0NYv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.136
country_id: 3017382
description:
Dec  3 01:09:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.136, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<G1w8Qf1EE+Vb51mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 01:09:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<lsLNQf1EG9gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 01:09:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<PLlcQv1EJNqkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.241
country_id: 3017382
description:
Dec  3 01:09:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.241, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UrasP/1EVbVb51nx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.246
country_id: 3017382
description:
Dec  3 01:09:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.246, lip=66.85.158.92, TLS: Connection closed, session=<n/dOQP1Ei7Vb51n2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 01:10:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<4ZTLQ/1EFsOiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-12-03 01:10:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:58069: 535 Incorrect authentication data (set_id=test@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-03 01:10:49 dovecot_login authenticator failed for ([211.228.92.253]) [125.19.154.158]:51984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.206.64
country_id: 6252001
description:
Dec  3 01:11:07 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.206.64, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qXPuRv1EPtaYIM5A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-03 01:11:21 dovecot_login authenticator failed for ([49.124.154.166]) [122.187.227.164]:60360: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 01:13:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<kx9ZTv1E3KrD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 01:15:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<4ajlVf1Evt/O7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.193.166
country_id: 290557
description:
2025-12-03 01:15:35 dovecot_login authenticator failed for (ADMIN) [217.138.193.166]:39789: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.209
country_id: 1733045
description:
2025-12-03 01:15:49 dovecot_login authenticator failed for ([65.20.144.28]) [49.124.149.209]:38810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-03 01:16:07 dovecot_login authenticator failed for ([125.19.156.2]) [91.219.196.17]:51732: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 01:16:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<pw1TW/1E8N+nYwhf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 01:17:23 host2 sshd[2333848]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-12-03 01:18:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:51607: 535 Incorrect authentication data (set_id=test@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 01:18:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<iJE3YP1EpLZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-03 01:18:30 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:40520: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 01:18:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<5yCIYv1EgKOOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.221
country_id: 953987
description:
Dec  3 01:19:14 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=102.64.33.221, lip=66.85.158.91, TLS, session=<ApWgYv1EbN1mQCHd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-12-03 01:19:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:53556: 535 Incorrect authentication data (set_id=test@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.188.201
country_id: 3469034
description:
Dec  3 01:19:36 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.179.188.201, lip=66.85.158.91, TLS, session=<BhgUZP1EMbots7zJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-12-03 01:20:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:61952: 535 Incorrect authentication data (set_id=test@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 01:20:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<0LWjaP1EcKwv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 01:21:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<I5TXav1EuOUm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 01:21:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<0FKga/1EztsrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-12-03 01:22:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:62779: 535 Incorrect authentication data (set_id=test@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 01:23:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<bDqWcf1EzKSB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 01:24:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<X40jdf1E4M0+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 01:27:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SA4/gv1ElpE+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.88
country_id: 6252001
description:
Dec  3 01:27:56 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.88, lip=66.85.158.91, TLS, session=<jvUTg/1E9P/N0h9Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 01:28:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<N0GGg/1EcK8vWGUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.3.107
country_id: 6251999
description:
Dec  3 01:31:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.105.3.107, lip=66.85.158.91, session=<okFqkP1EvoysaQNr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.3.107
country_id: 6251999
description:
Dec  3 01:31:52 host2 pure-ftpd[2343401]: (?@172.105.3.107) [INFO] New connection from 172.105.3.107


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 01:32:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<CVp8kf1EZt8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 01:32:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<MDQHlP1E2r4vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 01:33:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<Lm5/lv1EQsql0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 01:34:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<nkKQm/1E8pEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 01:35:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<pH7gnv1EBpmiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 01:35:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AzvVnf1E6qmkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.106
country_id: 3996063
description:
2025-12-03 01:36:03 dovecot_login authenticator failed for (ADMIN) [77.81.142.106]:47308: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 01:36:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<RmR5ov1EoKLD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 01:42:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<payWt/1EWJKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 01:42:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<3L+jtv1EUOvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 01:44:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<TrQCvf1EwuUv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 01:44:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<wMGvvv1EoOdnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 01:43:55 host2 sshd[2351190]: Disconnected from invalid user star 62.60.131.157 port 50244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 01:43:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<L+JUvP1EMIyOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 01:45:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<Sca4wP1Evucm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 01:46:24 host2 dovecot[2304439]: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts in 173 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<rzzHuv1EorLKm18C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.231
country_id: 798544
description:
Dec  3 01:47:23 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=178.219.97.231, lip=66.85.158.91, TLS, session=<dZCVx/1Eo6yy22Hn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.88
country_id: 3469034
description:
Dec  3 01:47:42 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=186.216.88.88, lip=66.85.158.91, TLS, session=<ZVa1yP1EmI262FhY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.73
country_id: 2264397
description:
Dec  3 01:48:12 host2 dovecot[2304439]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.73, lip=66.85.158.91, TLS, session=<MO6Cy/1Ead0tnIBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.71
country_id: 2264397
description:
Dec  3 01:48:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.71, lip=66.85.158.91, TLS, session=<dTCvy/1EhrgtnIBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.73
country_id: 2264397
description:
Dec  3 01:48:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.128.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<x9DKy/1Erc4tnIBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.72
country_id: 2264397
description:
Dec  3 01:48:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.72, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Nbbry/1Ep5UtnIBI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 01:48:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<lHmEzP1EPsIrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-03 01:49:55 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (spiksovess) [174.166.153.20]:41356: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 01:50:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<N79w0v1Ejq2B4rs4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  3 01:51:18 host2 sshd[2355824]: Disconnected from invalid user star 62.60.131.157 port 18561 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 01:51:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<CoC31v1Esrg+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 01:51:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<qFoY2P1E2KcvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  3 01:51:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<empq2P1Ews0+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.115
country_id: 6252001
description:
Dec  3 01:54:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.115, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yTDW4P1Eu96TuYRz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 01:54:39 host2 sshd[2358278]: Disconnected from invalid user admin 2.57.121.112 port 39178 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 01:56:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<coio6v1EpuUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 01:57:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<xPEz6/1EdNzANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.252.223.157
country_id: 719819
description:
2025-12-03 02:00:22 dovecot_login authenticator failed for (ADMIN) [185.252.223.157]:12729: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 02:00:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<yOVF9/1ENILD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 01:59:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wXho9f1EG7oz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 02:01:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<q9tX+f1EpMSl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 02:01:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=</k82+v1EyNCiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 02:01:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<EWoh+v1EUKOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 02:00:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<iSgT+f1EZtsXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 02:02:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<lVeX/v1E0MUvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-03 02:05:03 dovecot_login authenticator failed for ([203.129.225.4]) [122.187.230.38]:55272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 02:07:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<9nSSEf5E7o0v+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 02:08:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<ERaoE/5E7GOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 02:09:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<c+hnFv5ErJmOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 02:09:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<ghLDFv5Edukm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 02:09:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<cfxEF/5E3qHO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.59.30.180
country_id: 732800
description:
2025-12-03 02:09:43 dovecot_login authenticator failed for (194.59.30.180) [194.59.30.180]:45952: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 02:11:33 host2 sshd[2370429]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 02:11:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qmOEHf5EDrhnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.210.82
country_id: 130758
description:
Dec  3 02:17:00 host2 sshd[2374805]: Disconnected from invalid user teamspeak 62.60.210.82 port 39762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 02:17:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<cIT+M/5EhouB4rs4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.254.165.85
country_id: 6252001
description:
Dec  3 02:17:36 host2 sshd[2375212]: Invalid user cloudtourssrilan_travel from 157.254.165.85 port 60543


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.210.82
country_id: 130758
description:
Dec  3 02:18:19 host2 sshd[2375889]: Disconnected from invalid user stack 62.60.210.82 port 52486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.210.82
country_id: 130758
description:
Dec  3 02:19:39 host2 sshd[2376779]: Disconnected from invalid user user01 62.60.210.82 port 50576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.147
country_id: 6252001
description:
2025-12-03 02:19:44 dovecot_login authenticator failed for (ADMIN) [151.241.123.147]:33640: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.210.82
country_id: 130758
description:
Dec  3 02:20:59 host2 sshd[2377943]: Disconnected from invalid user asterisk 62.60.210.82 port 57276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-03 02:22:49 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:58918: 535 Incorrect authentication data (set_id=webmaster@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 02:22:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vcmuRP5Eip4v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.204.180
country_id: 2661886
description:
2025-12-03 02:23:34 dovecot_login authenticator failed for c213-100-204-180.bredband.tele2.se [213.100.204.180]:35552: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 02:24:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<wvU4TP5ExszD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.22
country_id: 3469034
description:
Dec  3 02:24:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.200.22, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D6BdTP5EDLeYIMgW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 02:25:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<4Lp0Uf5EBqDANXk9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.22
country_id: 3469034
description:
Dec  3 02:25:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.200.22, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bDkyT/5ENr+YIMgW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 02:25:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<HkQTT/5EOuIz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.137.193
country_id: 2921044
description:
Dec  3 02:26:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.137.193, lip=66.85.158.92, session=<QLmpVP5EUG+LO4nB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 02:26:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<5cq/VP5E2MuiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-03 02:26:43 dovecot_login authenticator failed for ([110.185.173.167]) [122.185.176.126]:47722: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Dec  3 02:26:49 host2 sshd[2382085]: Disconnected from invalid user bitwarden 103.213.238.91 port 37368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-03 02:26:14 dovecot_login authenticator failed for ([59.6.203.38]) [193.46.192.20]:59461: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.226.237
country_id: 2921044
description:
Dec  3 02:26:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.226.237, lip=66.85.158.92, session=<vGOjVP5Ej1suZeLt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 02:27:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<6TAGV/5EEuOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 02:28:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<XKxWW/5EAJel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 02:28:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cczaXP5EjpYXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.62.37
country_id: 3686110
description:
Dec  3 02:29:36 host2 sshd[2383718]: Disconnected from invalid user ansible 190.60.62.37 port 48238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 02:30:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<8WW4Yv5EWIg+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.62.37
country_id: 3686110
description:
Dec  3 02:31:24 host2 sshd[2385374]: Disconnected from invalid user erpnext 190.60.62.37 port 35404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 02:31:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<Zo/NZv5E2Lsv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 02:32:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<vdulaf5EtM0vWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Dec  3 02:31:57 host2 sshd[2385867]: Disconnected from invalid user ivan 103.213.238.91 port 38134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.206.64
country_id: 6252001
description:
Dec  3 02:32:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=152.32.206.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tKwqaP5EruCYIM5A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 02:33:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<LSWDbP5EYusm9w7I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Dec  3 02:33:22 host2 sshd[2386773]: Disconnected from invalid user ftpuser 103.213.238.91 port 39726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 02:34:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<t8aJcP5EMIqOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 02:34:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MnRNcf5EnhynYwhf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Dec  3 02:34:43 host2 sshd[2387715]: Disconnected from invalid user zjw 103.213.238.91 port 41318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 02:33:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<lYugbv5E8KY+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.62.37
country_id: 3686110
description:
Dec  3 02:33:53 host2 sshd[2387145]: Disconnected from invalid user sammy 190.60.62.37 port 47380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.62.37
country_id: 3686110
description:
Dec  3 02:35:06 host2 sshd[2388206]: Disconnected from invalid user bitrix 190.60.62.37 port 52968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.22
country_id: 2993457
description:
2025-12-03 02:36:24 dovecot_login authenticator failed for (ADMIN) [95.181.233.22]:44980: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 02:36:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<d0jFd/5EUpfO7iqJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.62.37
country_id: 3686110
description:
Dec  3 02:36:16 host2 sshd[2389156]: Disconnected from invalid user sammy 190.60.62.37 port 45212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 02:37:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<refHfP5EGIFnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 02:39:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<jDWOgf5EXpgvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 02:43:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<UbcWkP5EquErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 02:44:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<AT8ylv5EiO2B4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 02:47:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<tJxun/5EeLQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 02:47:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<RjqUn/5EJrcv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 02:47:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<fs7poP5EuJ/D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.66.55
country_id: 1269750
description:
2025-12-03 02:49:03 dovecot_login authenticator failed for ([127.0.0.1]) [122.165.66.55]:49150: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-03 02:49:16 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.181.62]:40780: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 02:49:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ze1VqP5ExJsz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 02:51:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<xAX7rv5E8NiiAOAm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.22
country_id: 3469034
description:
Dec  3 02:52:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.200.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<i39vsf5EvoCYIMgW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 02:53:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<HSsKtP5E7umkXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.200.22
country_id: 3469034
description:
Dec  3 02:52:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.200.22, lip=66.85.158.91, TLS, session=<PSYvs/5E3LiYIMgW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-03 02:55:33 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.13.69]:51372: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-03 02:55:39 dovecot_login authenticator failed for ([127.0.0.1]) [84.213.189.154]:44454: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 02:55:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<foC/vP5EYuEv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 02:55:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<5u0lvf5EXLOl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.126
country_id: 6252001
description:
2025-12-03 02:56:02 dovecot_login authenticator failed for (ADMIN) [95.181.238.126]:52994: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.203.44.163
country_id: 6251999
description:
Dec  3 02:57:49 host2 pure-ftpd[2406124]: (?@159.203.44.163) [INFO] New connection from 159.203.44.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 02:57:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<MwJ0xP5EnoI+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 02:57:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<syaxwv5ENu0m9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 02:59:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<RnHmyv5EmpWOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 03:00:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<AEr1zf5ESnCnYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.79.29.108
country_id: 1831722
description:
Dec  3 03:01:19 host2 sshd[2409342]: Disconnected from invalid user odoo15 202.79.29.108 port 40602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Dec  3 03:02:42 host2 sshd[2410384]: Disconnected from invalid user ts1 202.79.29.108 port 37564 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.89.143.166
country_id: 6252001
description:
2025-12-03 03:02:53 H=([38.89.143.166]) [38.89.143.166]:55275 F=<dpr@priv8shop.com> rejected RCPT <logs.boxz@yandex.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 03:03:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<ow0y1/5EHNQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 03:03:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<xSRk1/5E1pAvWGUU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-03 03:03:18 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 03:03:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<m6mM2P5E8urO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 03:04:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lQys3P5E6qtnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.79.29.108
country_id: 1831722
description:
Dec  3 03:05:46 host2 sshd[2413312]: Disconnected from invalid user sopuser 202.79.29.108 port 57618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.163.173
country_id: 6252001
description:
2025-12-03 03:06:17 dovecot_login authenticator failed for ([127.0.0.1]) [70.174.163.173]:33386: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.16.131
country_id: 3144096
description:
2025-12-03 03:06:23 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.16.131]:38800: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 03:06:39 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56986: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Dec  3 03:06:01 host2 sshd[2413564]: Disconnected from invalid user oracle 36.255.3.203 port 56962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.128
country_id: 3175395
description:
Dec  3 03:07:22 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=217.26.179.128, lip=66.85.158.91, TLS, session=<ZSSw5f5EIdTZGrOA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Dec  3 03:08:11 host2 sshd[2414889]: Disconnected from invalid user ir 36.255.3.203 port 47266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.163.198.144
country_id: 3469034
description:
Dec  3 03:07:52 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<info>, method=PLAIN, rip=45.163.198.144, lip=66.85.158.91, TLS, session=<Ddbb5v5EE88to8aQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 03:07:56 host2 sshd[2414716]: Disconnected from invalid user admin 2.57.121.112 port 20775 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.133
country_id: 6252001
description:
Dec  3 03:09:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.133, lip=66.85.158.91, TLS: Connection closed, session=<pz2W7P5EfNPHLZqF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.3.203
country_id: 1269750
description:
Dec  3 03:10:37 host2 sshd[2416523]: Disconnected from invalid user tecnopos 36.255.3.203 port 46147 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 03:10:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<muW38v5EcM0rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 03:11:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<w+cp9v5EKIfD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 03:12:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<+vwc+f5EWOqB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 03:12:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<bwNt+v5EAsMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Dec  3 03:13:03 host2 sshd[2418220]: Disconnected from invalid user student 36.255.3.203 port 45032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.118
country_id: 953987
description:
Dec  3 03:13:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=102.64.41.118, lip=66.85.158.91, TLS, session=<xLwO/P5E8YdmQCl2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 03:14:31 host2 sshd[2419155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.63
country_id: 3469034
description:
Dec  3 03:14:07 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=186.209.248.63, lip=66.85.158.91, TLS, session=<sRRa/f5ESsO60fg/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Dec  3 03:14:20 host2 sshd[2419059]: Disconnected from invalid user backend 36.255.3.203 port 58589 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 03:15:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<KWA3Av9E/8Mz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 03:16:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<X/h+Bf9ETqUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.29
country_id: 3042058
description:
2025-12-03 03:16:06 dovecot_login authenticator failed for (ADMIN) [91.90.122.29]:1907: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.85.155.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 66.85.155.91: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 03:17:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<tXsACv9E/umiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 03:19:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<lyLyEf9EDsikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 03:19:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<tBwlE/9EDpsv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-03 03:21:07 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (sophiabled) [50.74.136.134]:44994: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 03:21:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=</dtEGf9E4IAm9w7I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec  3 03:22:36 host2 sshd[2425198]: Disconnected from invalid user nishant 38.248.12.102 port 33094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 03:23:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<pImgIP9EsJWl0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.41.212
country_id: 6252001
description:
Dec  3 03:23:30 host2 sshd[2425605]: Disconnected from invalid user jacob 209.141.41.212 port 44146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec  3 03:24:12 host2 sshd[2426238]: Disconnected from invalid user postgres 197.225.146.23 port 55160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.7
country_id: 6252001
description:
2025-12-03 03:24:48 dovecot_login authenticator failed for wsip-184-191-243-7.fv.ks.cox.net ([127.0.0.1]) [184.191.243.7]:55797: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-03 03:24:55 dovecot_login authenticator failed for ([127.0.0.1]) [78.156.0.88]:35794: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.41.212
country_id: 6252001
description:
Dec  3 03:25:05 host2 sshd[2426977]: Disconnected from invalid user sales1 209.141.41.212 port 42852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-03 03:25:00 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:42570: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 03:25:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<q+5dJv9EGrmOXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-03 03:25:21 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:50428: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec  3 03:25:36 host2 sshd[2427314]: Disconnected from invalid user qw 154.221.27.234 port 59844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec  3 03:26:25 host2 sshd[2427768]: Disconnected from invalid user sftpuser 38.248.12.102 port 52580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec  3 03:27:06 host2 sshd[2428281]: Disconnected from invalid user userroot 154.221.27.234 port 44808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 03:27:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<uILvLf9EQokvWGUU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec  3 03:27:30 host2 sshd[2428485]: Disconnected from invalid user fred 38.248.12.102 port 50288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 03:26:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dXNZLP9ElpOnYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.207.179
country_id: 6252001
description:
Dec  3 03:28:45 host2 dovecot[2304439]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=152.32.207.179, lip=66.85.158.91, TLS, session=<+0glM/9Egs6YIM+z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.207.179
country_id: 6252001
description:
Dec  3 03:28:45 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.207.179, lip=66.85.158.91, session=<UmwfM/9E1M2YIM+z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.27.234
country_id: 1819730
description:
Dec  3 03:28:33 host2 sshd[2429045]: Disconnected from invalid user dev 154.221.27.234 port 58004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec  3 03:28:36 host2 sshd[2429091]: Disconnected from invalid user hello 38.248.12.102 port 59162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.27.234
country_id: 1819730
description:
Dec  3 03:29:58 host2 sshd[2429715]: Disconnected from invalid user odoo 154.221.27.234 port 42966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec  3 03:30:23 host2 sshd[2430253]: Disconnected from invalid user fan 197.225.146.23 port 49404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 03:30:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<SoKbOf9EFM3O7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 03:31:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nodvPf9Ebtlnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec  3 03:31:50 host2 sshd[2431230]: Disconnected from invalid user odin 197.225.146.23 port 33392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.225.146.23
country_id: 934292
description:
Dec  3 03:33:18 host2 sshd[2432333]: Disconnected from invalid user fred 197.225.146.23 port 48668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 03:32:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<hKYiQv9EhtkvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 03:36:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<CyS1Tf9EKsTD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.73
country_id: 2510769
description:
2025-12-03 03:36:31 dovecot_login authenticator failed for (ADMIN) [212.102.49.73]:48287: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 03:37:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<uLYsU/9EUok+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 03:38:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<uRVQVf9E9Ikv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 03:38:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<H8uMVf9EkM0rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 03:40:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<VLRZXP9E3qiB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 03:40:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<O0F4XP9EZuwz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 03:41:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=</9VaYf9EwNM+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 03:42:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<mDSJZf9ENuCiAOAm>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-12-03 03:43:34 H=([87.120.36.32]) [87.120.36.32]:61110 F=<info@aspen.jp> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 03:44:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<TjbIaf9ESMbKm18C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 03:44:53 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:54270: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 03:45:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<eADcbf9EFLcv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 03:46:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bWO/cP9EHoSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 03:47:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<9TtrdP9EuIMm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 03:50:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<Jfgkgv9EIoWOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 03:51:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<XwOkhP9E3sml0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 03:52:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<7AWph/9EaufANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 03:52:55 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:56508: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 03:53:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<uz3hif9EWoIvWGUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.219
country_id: 2921044
description:
Dec  3 03:53:04 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=57.129.64.219, lip=66.85.158.91, session=<E/8Ziv9EB7s5gUDb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 03:53:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<uUwQi/9EaEmnYwhf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 03:54:18 host2 sshd[2447294]: Disconnected from invalid user admin 2.57.121.112 port 50168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.103.10
country_id: 6252001
description:
2025-12-03 03:54:44 dovecot_login authenticator failed for (ADMIN) [191.96.103.10]:47810: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.211.131
country_id: 6251999
description:
Dec  3 03:55:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.211.131, lip=66.85.158.91, TLS: Connection closed, session=<a44Xkf9EceaUcdOD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec  3 03:56:27 host2 sshd[2448708]: Disconnected from invalid user laravel 34.66.223.68 port 52442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 03:58:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<Jmx4nP9EyNTO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.5
country_id: 2750405
description:
Dec  3 03:59:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=31.14.32.5, lip=66.85.158.91, session=<gqnEn/9EB+cfDiAF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 03:58:57 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:53382: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 03:58:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Secin/9EjMJnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec  3 04:00:37 host2 sshd[2451545]: Disconnected from invalid user ionadmin 8.243.50.114 port 44024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 04:01:37 host2 sshd[2452289]: Disconnected from invalid user user 2.57.121.25 port 50068 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.223.68
country_id: 6252001
description:
Dec  3 04:00:53 host2 sshd[2451828]: Disconnected from invalid user customer 34.66.223.68 port 52172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 04:02:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<ldOFq/9EDKjD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec  3 04:02:59 host2 sshd[2453221]: Disconnected from invalid user redmine 34.66.223.68 port 38256 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.46
country_id: 798544
description:
Dec  3 04:03:12 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=195.184.82.46, lip=66.85.158.91, TLS, session=<o+lVrf9E077DuFIu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec  3 04:03:24 host2 sshd[2453956]: Disconnected from invalid user kafka 8.243.50.114 port 47284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Dec  3 04:03:33 host2 sshd[2454040]: Disconnected from invalid user castle 186.31.95.163 port 43690 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 04:03:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<zuW/r/9E6N8vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.93
country_id: 3865483
description:
Dec  3 04:03:38 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=181.225.195.93, lip=66.85.158.91, TLS, session=<IAyIrv9EcNm14cNd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 04:04:50 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:49336: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 04:04:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q+imsf9EkOov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Dec  3 04:05:13 host2 sshd[2455751]: Disconnected from invalid user ubuntu 186.31.95.163 port 60366 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.50.114
country_id: 3469034
description:
Dec  3 04:06:03 host2 sshd[2456810]: Disconnected from invalid user ts3 8.243.50.114 port 50524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.158.235
country_id: 1819730
description:
Dec  3 04:06:43 host2 sshd[2457310]: Disconnected from invalid user lch 103.146.158.235 port 53382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 04:06:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<MyFZuP9E8uw+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 04:06:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<7JwGuf9EzKcz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.67
country_id: 6252001
description:
Dec  3 04:06:31 host2 sshd[2457162]: Disconnected from invalid user lch 166.88.160.67 port 41098 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 04:06:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<O0pAuP9E9o8rmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Dec  3 04:06:52 host2 sshd[2457392]: Disconnected from invalid user ts3 186.31.95.163 port 34936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec  3 04:07:26 host2 sshd[2457735]: Disconnected from invalid user ubuntu 8.243.50.114 port 52154 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 04:08:32 host2 sshd[2458617]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 04:08:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<VWCIv/9E9rKB4rs4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.31.95.163
country_id: 3686110
description:
Dec  3 04:08:30 host2 sshd[2458564]: Disconnected from invalid user customer 186.31.95.163 port 38000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Dec  3 04:08:34 host2 sshd[2458630]: Disconnected from invalid user admin 152.32.144.167 port 60482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 04:09:08 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<zh5tw/9EnNiiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.59.213
country_id: 6252001
description:
2025-12-03 04:10:14 dovecot_login authenticator failed for ip198-71-59-213.pbiaas.com (ADMIN) [198.71.59.213]:62223: 535 Incorrect authentication data (set_id=test@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 04:11:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<r1m8zP9EZskv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-03 04:10:54 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (douted) [73.137.7.97]:48232: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Dec  3 04:12:07 host2 sshd[2461420]: Disconnected from invalid user nexus 152.32.144.167 port 51806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.235.220.67
country_id: 357994
description:
2025-12-03 04:12:40 dovecot_plain authenticator failed for (10I184C09IJ1) [41.235.220.67]:4496: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec  3 04:11:59 host2 sshd[2461232]: Disconnected from invalid user tester 103.171.85.124 port 44282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 04:16:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<dxaF3/9ELMKOXXSy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec  3 04:17:28 host2 sshd[2465960]: Disconnected from invalid user airflow 103.171.85.124 port 45280 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 04:19:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<aDSU6P9EAOovWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 04:20:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<37226v9ENHKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 04:20:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<6yjq6v9EKrOl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 04:22:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<bz6H8v9EcrrANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 04:26:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<ngkAAABFINPO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 04:26:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fCBKAQBFPJVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec  3 04:27:59 host2 sshd[2471889]: Disconnected from invalid user david 103.153.190.105 port 55722 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 04:29:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<0b0/DABFHrMv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 04:28:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<OTIBCgBFDpbD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-03 04:31:09 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:35418: 535 Incorrect authentication data (set_id=jobs@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-03 04:31:22 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:55495: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 04:31:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<bgd2EwBFQdAz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 04:31:51 host2 sshd[2474984]: Disconnected from invalid user admin 2.57.121.112 port 38805 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec  3 04:32:07 host2 sshd[2475365]: Disconnected from invalid user ubuntu 103.153.190.105 port 36701 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 04:33:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<g5+8GgBFdOYvWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-03 04:33:51 dovecot_login authenticator failed for ([106.0.165.219]) [152.52.236.2]:49710: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-03 04:33:16 dovecot_login authenticator failed for ([110.77.137.236]) [125.17.124.75]:60940: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 04:33:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<zSy6GQBFDpormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 04:34:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<t9cVHwBFwsyiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 04:35:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<lkDPIABF+OuB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.40.64.155
country_id: 1269750
description:
Dec  3 04:35:31 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.40.64.155, lip=66.85.158.91, TLS, session=<KAjfIABF97xnKECb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.36
country_id: 3144096
description:
2025-12-03 04:35:35 dovecot_login authenticator failed for (ADMIN) [46.246.122.36]:47883: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.63
country_id: 3469034
description:
Dec  3 04:36:29 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 42 secs): user=<info>, method=PLAIN, rip=186.209.248.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<j+zZIgBFN+C60fg/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.117.16.118
country_id: 3865483
description:
Dec  3 04:36:30 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=138.117.16.118, lip=66.85.158.91, TLS, session=<xB5mJQBFjZeKdRB2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 04:37:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<6k54JwBFmsQv+44t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 04:38:15 host2 sshd[2479440]: Disconnected from invalid user admin 2.57.121.112 port 44535 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 04:38:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</5vBLQBFjK6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 04:39:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<00RoLwBFZoom9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-03 04:39:58 dovecot_plain authenticator failed for (irant) [65.20.233.110]:48889: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 04:41:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<sKgHOABFotmOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 04:44:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<uPTcQQBFvuIvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 04:45:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<QyTHQwBFxLk+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 04:45:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Y6wYRgBF6l+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 04:47:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<ALf6TABFqJGl0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.43
country_id: 6252001
description:
Dec  3 04:47:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.43, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Sxm7SwBFcNaTuYQr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 04:48:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<doB4UABFVrM+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 04:49:30 host2 sshd[2487763]: Disconnected from invalid user user 2.57.121.25 port 35666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec  3 04:48:55 host2 sshd[2487152]: Disconnected from invalid user ubuntu 103.153.190.105 port 54256 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.87
country_id: 6252001
description:
Dec  3 04:50:09 host2 pure-ftpd[2488526]: (?@205.210.31.87) [INFO] New connection from 205.210.31.87


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Dec  3 04:52:23 host2 sshd[2490313]: Disconnected from invalid user ekp 123.58.213.127 port 58446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 04:51:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<qMZbXABF5LLO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 04:52:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VzIIXgBFHIBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 04:53:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<+cCWYgBFpprD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 04:53:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BFG1YgBFfo0v/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.3.154.37
country_id: 6252001
description:
Dec  3 04:53:55 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.3.154.37, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Uyy7YwBFTo7AA5ol>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 04:55:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<UYe0aQBFKogz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Dec  3 04:56:02 host2 sshd[2493258]: Disconnected from invalid user tidb 123.58.213.127 port 49404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 04:57:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<uKq/bwBFsiNRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Dec  3 04:58:30 host2 sshd[2495667]: Disconnected from invalid user default 123.58.213.127 port 58138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec  3 04:58:04 host2 sshd[2495151]: Disconnected from invalid user lab 210.79.142.221 port 33462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.74
country_id: 783754
description:
2025-12-03 04:58:25 dovecot_login authenticator failed for (ADMIN) [31.171.154.74]:54810: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 04:59:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<iTI5dwBFIqcrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 04:59:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<AoZbdwBFLraiAOAm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Dec  3 04:59:42 host2 sshd[2497110]: Disconnected from invalid user test123 123.58.213.127 port 46186 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.101.182
country_id: 2921044
description:
Dec  3 05:01:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.101.182, lip=66.85.158.92, TLS, session=<Hz2afQBF0vGd5mW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.214
country_id: 6252001
description:
Dec  3 05:01:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.214, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eFfwfQBFQsvG6xjW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 05:01:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<GJ6pfgBFPrSB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 05:01:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<bc1tgABFHNwv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 05:03:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<BV08hABFZugvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 05:04:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Q1UyiABFhq6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 05:04:06 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<vwUHiABFCo0m9w7I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec  3 05:06:05 host2 sshd[2504708]: Disconnected from invalid user cyril 103.153.190.105 port 54332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-03 05:06:16 dovecot_plain authenticator failed for (nontomads) [65.20.184.80]:58015: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-03 05:06:19 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (expromene) [196.47.172.253]:47846: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 05:06:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<OHQwkABFUpmOXXSy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.129
country_id: 6252001
description:
Dec  3 05:06:30 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.129, lip=66.85.158.92, TLS, session=<dW20kABFhP+TuYSB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec  3 05:08:16 host2 sshd[2506557]: Disconnected from invalid user ts 210.79.142.221 port 46962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 05:09:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<Tk/lmgBFwNsvWGUU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec  3 05:10:50 host2 sshd[2510143]: Disconnected from invalid user sammy 210.79.142.221 port 36732 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 05:11:42 host2 sshd[2510918]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 05:11:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<llvQoABFlKanYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 05:12:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<1yDipQBFzOw+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-12-03 05:14:32 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au (95-87-213-16.ip.btc-net.bg) [203.174.182.38]:49337: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec  3 05:14:06 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS, session=<herfqwBFor1ChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-03 05:14:21 dovecot_login authenticator failed for ([110.9.78.118]) [203.124.50.151]:34037: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 05:15:01 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<UtUUrwBFfpil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.97
country_id: 798544
description:
Dec  3 05:15:14 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=91.228.33.97, lip=66.85.158.91, TLS, session=<Tkf+rgBFw8hb5CFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.44
country_id: 3469034
description:
Dec  3 05:15:39 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.85.104.44, lip=66.85.158.91, TLS, session=<YKIlsABFKYC7VWgs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Dec  3 05:16:26 host2 sshd[2515813]: Disconnected from invalid user userm 85.185.120.213 port 57986 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 05:17:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<cHBXuABFCKrO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 05:18:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<veqDugBFzOkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 05:18:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<wjuLuwBF5olnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 05:18:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=</wW/uwBFTKzD+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.94
country_id: 2921044
description:
2025-12-03 05:17:53 dovecot_login authenticator failed for (ADMIN) [212.102.57.94]:59407: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.185.120.213
country_id: 130758
description:
Dec  3 05:18:59 host2 sshd[2517895]: Disconnected from invalid user kyt 85.185.120.213 port 60478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.173.73
country_id: 1269750
description:
Dec  3 05:19:04 host2 sshd[2518067]: Disconnected from invalid user roots 64.227.173.73 port 39308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-03 05:20:05 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (locros) [196.47.172.253]:52952: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 05:20:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<uvxMwQBFJq8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 05:20:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<21trwQBFBpPANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-03 05:21:57 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (prover) [73.144.27.228]:39192: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 05:24:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<siHG0ABFJu2iAOAm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.173.73
country_id: 1269750
description:
Dec  3 05:25:26 host2 sshd[2527805]: Disconnected from invalid user nominatim 64.227.173.73 port 51270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 05:25:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<Bb/D1QBFwL4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 05:27:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<vwcq3QBFEo2B4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 05:27:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<2rIe3QBF/tMv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 05:29:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<FJa+4gBF8I8m9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 05:29:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<gihT4wBFKrmkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 05:32:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<yRL37ABFxOIvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 05:32:09 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<WK9R7ABFAo6OXXSy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.254
country_id: 6252001
description:
Dec  3 05:35:16 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.254, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<C8+T9wBFhNfN0h/+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 05:35:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<ueR3+ABFZtUvWGUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.245
country_id: 6252001
description:
2025-12-03 05:35:36 dovecot_login authenticator failed for (ADMIN) [212.32.50.245]:49214: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec  3 05:35:45 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jrBT+QBFTNNChJlx>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.139
country_id: 6252001
description:
Dec  3 05:36:50 host2 pure-ftpd[2536633]: (?@198.235.24.139) [INFO] New connection from 198.235.24.139


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.17
country_id: 3175395
description:
Dec  3 05:36:28 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.15.169.17, lip=66.85.158.91, TLS, session=<ajzJ+gBF5te5D6kR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.29
country_id: 3469034
description:
Dec  3 05:36:47 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.130.168.29, lip=66.85.158.91, TLS, session=<ucj7+wBFOsaxgqgd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 05:36:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iY9f/QBF8IOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-12-03 05:37:44 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:55521: 535 Incorrect authentication data (set_id=media@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-03 05:38:15 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:60708: 535 Incorrect authentication data (set_id=media)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 05:38:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<aIVPAwFFLtZRvaKO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 05:42:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5yx4EgFFEpQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 05:43:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HvWKFAFFkLPO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 05:42:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<HneXEgFFjs2l0xnK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.18
country_id: 6252001
description:
Dec  3 05:43:55 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.18, lip=66.85.158.92, TLS, session=<7PuGFgFF8vrN0h8S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 05:44:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<fMW4GQFF69Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 05:44:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zAgcGgFFHrBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 05:45:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<p1ZkGgFFPp/D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 05:45:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cX7iGwFF7r4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 05:46:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<lhRtIAFFxLbKm18C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec  3 05:48:02 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<bZVDJQFFgf8t4/6Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 05:49:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<vf5GKgFFxNM+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 05:49:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<LWKYKgFFytCiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 05:49:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<5DPYKwFFnJfANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-03 05:51:27 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (refus) [73.0.235.30]:33366: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 87.120.36.32
country_id: 3175395
description:
2025-12-03 05:52:24 H=([87.120.36.32]) [87.120.36.32]:59073 F=<info@aspen.jp> rejected RCPT <amaslim90@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 05:52:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<pT9GNQFFRMsrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 05:53:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<aUDqNwFFvIE+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 05:53:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<i4f4NwFFYogv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 05:54:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<jMMhPQFFvIeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 05:55:11 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<dgC1PgFFApQm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 05:55:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<cAd8PwFFxrykXF7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.30
country_id: 6252001
description:
Dec  3 05:55:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.30, lip=66.85.158.92, session=<HvBAQAFFddXDuEwe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.107
country_id: 6252001
description:
Dec  3 05:55:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.107, lip=66.85.158.92, session=<8ZneQAFFnarDuExr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.30
country_id: 6252001
description:
Dec  3 05:55:54 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.30, lip=66.85.158.92, session=<3zhcQQFFgbrDuEwe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.24
country_id: 6252001
description:
Dec  3 05:55:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.24, lip=66.85.158.92, session=<gAiMQQFFBY/DuEwY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 05:57:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<Pnz/RwFFZM6OXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.159
country_id: 3077311
description:
2025-12-03 05:57:43 dovecot_login authenticator failed for (ADMIN) [212.102.39.159]:9893: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.125.109
country_id: 6252001
description:
Dec  3 05:57:43 host2 pure-ftpd[2550222]: (?@159.223.125.109) [INFO] New connection from 159.223.125.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.164.126.21
country_id: 1269750
description:
2025-12-03 06:00:11 dovecot_login authenticator failed for ([68.71.242.113]) [122.164.126.21]:42090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-03 06:00:38 dovecot_login authenticator failed for ([178.178.222.55]) [196.188.187.85]:59754: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.137.193
country_id: 2921044
description:
Dec  3 06:00:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.137.193, lip=66.85.158.91, TLS, session=<z7TXUgFFbEaLO4nB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 06:01:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<xtMUVAFFfs4vWGUU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Dec  3 06:01:13 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.83, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EUNoVAFFc8fN0h9T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 06:01:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<qDXDVgFFat0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:02:58 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<nDyIWgFFSD6nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-03 06:03:04 dovecot_login authenticator failed for ([127.0.0.1]) [49.0.40.238]:39642: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  3 06:05:44 host2 sshd[2555171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:07:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7xiqawFF2JAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 06:09:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<W7xBcwFFs5Az0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 06:09:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<W8lbcwFFxNzO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 06:10:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<c+czdgFFlNnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 06:11:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<tjBbdwFFbJKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 06:11:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<3tv1eQFFdqdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 06:14:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<MtD3hAFF/uiiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 06:16:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<RswriQFFOKkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.42
country_id: 3042225
description:
2025-12-03 06:18:29 dovecot_login authenticator failed for (ADMIN) [91.90.124.42]:28141: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 06:18:54 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<d2mFkwFFqMgv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 06:19:26 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<J69ylQFFsMMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 06:19:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=</rIKlgFFqNo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 06:20:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<keRzmAFFmpYm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 06:21:31 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AfvgnAFFYKekXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 06:21:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<it6hnQFFHoOB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 06:23:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<goBlowFFSp2OXXSy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Dec  3 06:23:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<WmJdpQFFtJunXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-03 06:25:58 dovecot_login authenticator failed for ([51.162.194.94]) [182.95.174.18]:41410: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 06:27:10 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<aLkSsQFFsMcvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:29:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<iKZBuQFFbGunYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-03 06:29:02 dovecot_login authenticator failed for ([68.71.243.10]) [177.128.209.48]:52338: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.193
country_id: 1733045
description:
2025-12-03 06:29:17 dovecot_login authenticator failed for (host-86-111-91-69.566f.la.net.ua) [49.124.148.193]:58910: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.232
country_id: 6252001
description:
Dec  3 06:30:05 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=44.220.188.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<YXiauwFFwNMs3Lzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:32:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+xlbxQFFruYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 06:32:29 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<TCMSxAFF2NgvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 06:35:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wh/6zQFFcLkz0msW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.161.174.170
country_id: 6251999
description:
Dec  3 06:34:54 host2 pure-ftpd[2572690]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.161.174.170
country_id: 6251999
description:
Dec  3 06:35:11 host2 pure-ftpd[2573027]: (?@51.161.174.170) [INFO] New connection from 51.161.174.170


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 06:36:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<hXAc0wFFMKzD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 06:36:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<KiBn0wFFVKPO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.6
country_id: 3194884
description:
2025-12-03 06:36:48 dovecot_login authenticator failed for (ADMIN) [176.125.229.6]:10740: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 06:38:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5iNy2gFFnNpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 06:38:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<1iXh2gFF3Jel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 06:40:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<KDYu4QFFnO2iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-03 06:44:18 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:58248: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2025-12-03 06:44:34 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [117.248.107.130]:38784: 535 Incorrect authentication data (set_id=monitoring)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 06:44:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<bp277wFFBKIv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 06:45:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<Ztry8gFFOJsm9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-03 06:46:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55398: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 06:46:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<SX359gFFDpQrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 06:48:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<OLyT+wFFaMukXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-03 06:48:11 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (fleuddy) [67.172.54.29]:36236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-03 06:48:14 dovecot_plain authenticator failed for (verbuchent) [24.93.140.162]:57842: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 06:48:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<4EA1/QFFkrrANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 06:49:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<3p9j/wFFuLiB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 06:49:12 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<0wTc/wFFsqaOXXSy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec  3 06:50:54 host2 sshd[2580922]: Disconnected from invalid user user 2.57.121.25 port 31427 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.72.52
country_id: 2921044
description:
Dec  3 06:52:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.72.52, lip=66.85.158.91, TLS, session=<QscOCwJFjuuGekg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 06:53:28 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<LN0lDwJF6sEvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 06:56:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<LciNGQJFTiKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 06:57:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<svPwGwJF5N0+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.48
country_id: 3703430
description:
2025-12-03 06:57:18 dovecot_login authenticator failed for (ADMIN) [91.90.126.48]:50964: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-03 06:58:48 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (vioninglo) [87.103.126.54]:17364: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 06:58:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<edm9HwJFwpUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 06:58:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<1r0NIgJF/NA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:00:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<gYXWKQJFueIz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:01:14 host2 sshd[2588126]: Disconnected from invalid user server 103.105.176.66 port 38410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:01:27 host2 sshd[2588329]: Disconnected from invalid user jenkins 103.23.199.128 port 38216 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 07:02:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Eqh8LwJFBsovWbHj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:02:33 host2 sshd[2588903]: Disconnected from invalid user backend 103.105.176.66 port 46908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:02:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<easYMAJFrrnD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:03:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<1uEjMgJFCJLO7iqJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Dec  3 07:03:50 host2 sshd[2590268]: Disconnected from invalid user reza 103.105.176.66 port 45376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:04:53 host2 sshd[2590758]: Disconnected from invalid user teamspeak 103.23.199.128 port 46694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 07:06:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<iQZcPAJFAuZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:06:41 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<SrxiPgJFFKWiAOAm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.128
country_id: 1643084
description:
Dec  3 07:06:42 host2 sshd[2592098]: Disconnected from invalid user testing 103.23.199.128 port 45814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-03 07:06:01 dovecot_login authenticator failed for ([183.171.154.31]) [122.186.64.86]:36656: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:07:13 host2 sshd[2592417]: Disconnected from invalid user mika 103.72.147.99 port 43160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 07:07:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<gjYrQQJFLOil0xnK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:08:29 host2 sshd[2593240]: Disconnected from invalid user aaa 103.72.147.99 port 35242 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-03 07:08:33 dovecot_login authenticator failed for ([219.138.200.44]) [103.90.27.83]:55174: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec  3 07:09:33 host2 sshd[2593989]: Disconnected from invalid user fan 12.189.234.28 port 46216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Dec  3 07:09:43 host2 sshd[2594065]: Disconnected from invalid user runner 103.72.147.99 port 35954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-03 07:09:20 dovecot_login authenticator failed for (azteca-comunicaciones.com) [103.90.27.83]:40504: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.3
country_id: 3042058
description:
2025-12-03 07:17:57 dovecot_login authenticator failed for (ADMIN) [91.90.122.3]:57570: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 07:18:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<eXflZgJFnuLANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 07:19:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<J8rGbAJFgLsvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 07:23:46 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<E0CFewJFOqov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 07:22:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<MHeaeAJF3oKnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:26:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<NGOrhgJFWJ8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 07:28:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<7SP/jAJFuLI+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.230
country_id: 3017382
description:
Dec  3 07:28:39 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.230, lip=66.85.158.92, session=<mQEPjQJFS6Nb51nm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.76
country_id: 3017382
description:
Dec  3 07:28:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.76, lip=66.85.158.92, session=<a2asjQJFS59b51lM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:29:00 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<NqU0jgJF0uLD+hnW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.231
country_id: 3017382
description:
Dec  3 07:29:02 host2 dovecot[2304439]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.231, lip=66.85.158.92, session=<QClzjgJFCapb51nn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.227
country_id: 3017382
description:
Dec  3 07:29:05 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.227, lip=66.85.158.92, session=<v2CljgJFe7db51nj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:29:48 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<lMgOkQJFdsnO7iqJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.122.51
country_id: 6252001
description:
Dec  3 07:32:01 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.122.51, lip=66.85.158.91, session=<z1gmmQJFBNVo+Hoz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 07:33:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<wMHdnQJFFLsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:33:04 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<n8HEnAJFlr6iAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 07:33:19 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<9amknQJFJpRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 07:36:18 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<JGVTqAJFioel0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 07:36:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<1lflqQJF3qEm9w7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 07:37:34 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MTHdrAJFhucXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 07:36:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<6QUxqgJF+KUv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Dec  3 07:38:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<7CSFrwJFwrlHBobm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 07:40:53 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uVy3uAJF+MykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 07:40:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<VSHSuAJFELGOXXSy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.67
country_id: 2510769
description:
2025-12-03 07:41:05 dovecot_login authenticator failed for (ADMIN) [212.102.49.67]:53867: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 07:42:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<DbyxvQJFcqYrmxBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.122.51
country_id: 6252001
description:
Dec  3 07:42:00 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.122.51, lip=66.85.158.92, session=<3TnRvAJFHqdo+Hoz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 07:44:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<rd9qxgJFioiB4rs4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:45:03 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LK2+xwJFGskjy9Nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:45:52 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<Sb6kygJFWP4jy9Nz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 07:45:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<H7WzygJF7LQvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 07:47:50 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<VhOV0QJFHrrANXk9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 07:49:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kH4/2AJFiJ8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 07:50:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Tj1y2QJFDJSnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-03 07:51:30 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:53804: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  3 07:51:59 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS, session=<Xd6L4AJFUOsjy9Nz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-03 07:52:13 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:57052: 535 Incorrect authentication data (set_id=noreply)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 07:53:02 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Vs0i5AJFi8kz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 07:55:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<5M0m7AJFrt3D+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 07:56:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<XcaT8AJFKKvO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 07:59:40 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<NQ3i+wJF5IiiAOAm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 07:59:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<SvVD/AJFxNUjy9K9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:00:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 27 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<P9MT/wJFeuwjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 08:00:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dNOh/wJFxMtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.155.95.2
country_id: 1643084
description:
Dec  3 07:59:50 host2 dovecot[2304439]: pop3-login: Disconnected: Inactivity (auth failed, 1 attempts in 177 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=202.155.95.2, lip=66.85.158.91, session=<PdIQ8gJFJKnKm18C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:00:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Npd7AANFGPQjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 08:02:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<Wqi2BQNF7qQm9w7I>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Dec  3 08:01:52 host2 sshd[2630409]: Disconnected from invalid user fan 186.233.118.22 port 41212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 08:03:15 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<ah+1CANFZLQv+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.197
country_id: 6252001
description:
2025-12-03 08:03:24 dovecot_login authenticator failed for (ADMIN) [191.101.61.197]:11330: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 08:04:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<jYStDANFSKwvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  3 08:04:43 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<1RDsDQNFdpY+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  3 08:05:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<Q7ADEQNFDNs+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  3 08:04:49 host2 sshd[2632218]: Disconnected from invalid user admin 2.57.121.112 port 63625 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 08:05:14 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<TR7RDwNFTqil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 08:07:07 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<FrqGFgNFVLSOXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  3 08:07:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<b75KGANFCr4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 08:07:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<imOZGANFkI+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  3 08:09:17 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<nfBGHgNF8V1RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.189
country_id: 2635167
description:
Dec  3 08:08:51 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.189, lip=66.85.158.91, TLS, session=<623YHANFwPQjy9K9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 08:10:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<Qt0aIgNFfKsrmxBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Dec  3 08:11:00 host2 sshd[2636628]: Disconnected from invalid user valheim 158.174.211.17 port 22477 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 08:12:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<sA7wKQNFhK4vWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 08:12:38 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<ETxAKgNFUoeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.226.5
country_id: 3469034
description:
Dec  3 08:16:15 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=168.0.226.5, lip=66.85.158.91, TLS, session=<E+UiNgNFRL6oAOIF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.106
country_id: 3469034
description:
Dec  3 08:16:35 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.251.106, lip=66.85.158.91, TLS, session=<b5lnNwNFi+u60ftq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.211.17
country_id: 2661886
description:
Dec  3 08:17:10 host2 sshd[2641300]: Disconnected from invalid user kingbase 158.174.211.17 port 26026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 08:17:20 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<6YQWOwNFAJWnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 08:19:32 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ldnwQgNFLYYz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.3
country_id: 3469034
description:
Dec  3 08:21:21 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.11.251.3, lip=66.85.158.91, TLS, session=<kO9uSANFHK6xC/sD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.90.150
country_id: 3469034
description:
Dec  3 08:21:41 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.22.90.150, lip=66.85.158.91, TLS, session=<vyeoSQNFPsuxFlqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 08:21:55 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<9952SwNFFqDD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 08:23:23 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<+8W3UANFttfO7iqJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.7.29.204
country_id: 2205218
description:
2025-12-03 08:24:12 dovecot_plain authenticator failed for broadband-dynamic-central-210-7-29-204.connect.com.fj (D5USN7IUSI1V) [210.7.29.204]:47627: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.235
country_id: 718075
description:
2025-12-03 08:24:47 dovecot_login authenticator failed for (ADMIN) [185.225.28.235]:1314: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2025-12-03 08:25:52 dovecot_plain authenticator failed for (psysoodhed) [196.219.216.146]:41090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  3 08:26:36 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=162.0.224.38, lip=66.85.158.91, session=<chM2XANFRJuiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec  3 08:28:37 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tfFsYwNF/M9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.247.14.200
country_id: 6252001
description:
Dec  3 08:28:16 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=38.247.14.200, lip=66.85.158.91, session=<doYoYgNF7qcm9w7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-03 08:29:55 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (prozintaby) [87.103.126.54]:25944: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec  3 08:29:42 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<IpFIZwNFXtov+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  3 08:33:33 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=142.93.116.178, lip=66.85.158.91, session=<DjsOdQNF/J+OXXSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec  3 08:34:44 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<IwJIeQNFht+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Dec  3 08:34:57 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@anandaobauae.org>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<NS4QegNFJril0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec  3 08:35:45 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<BijnfANFPJ0vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.227.65.166
country_id: 3469034
description:
Dec  3 08:36:12 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=168.227.65.166, lip=66.85.158.91, TLS, session=<mR6tfQNFOc+o40Gm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.152
country_id: 953987
description:
Dec  3 08:36:33 host2 dovecot[2304439]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.45.152, lip=66.85.158.91, TLS, session=<1nTUfgNF28lmQC2Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec  3 08:38:30 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<hg2/hgNFvLIrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  3 08:39:22 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<Z7fQiQNFVoo+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.101.20
country_id: 6252001
description:
Dec  3 08:39:24 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.88.101.20, lip=66.85.158.91, session=<tib7iQNFeKgvWGUU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Dec  3 08:40:49 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=129.226.187.56, lip=66.85.158.91, session=<eX4IjwNFWKiB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-03 08:41:11 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (duchypeky) [73.145.107.251]:49896: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec  3 08:42:21 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<IrmLlANFpoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec  3 08:44:56 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dIe+nQNFCgSnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec  3 08:46:25 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<+PgPowNF7rEz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.125
country_id: 2960313
description:
2025-12-03 08:46:40 dovecot_login authenticator failed for (ADMIN) [37.46.113.125]:41411: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.157.172.114
country_id: 1327865
description:
2025-12-03 08:47:09 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [204.157.172.114]:10643: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.53.121.61
country_id: 6251999
description:
Dec  3 08:47:35 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=192.53.121.61, lip=66.85.158.91, session=<kh9EpwNFRqnANXk9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-03 08:47:46 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.10.140]:59484: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-03 08:47:53 dovecot_login authenticator failed for ([127.0.0.1]) [187.161.213.35]:37869: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec  3 08:48:47 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<m76LqwNFcufD+hnW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  3 08:50:27 host2 dovecot[2304439]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<YQuFsQNFiLTO7iqJ>


