# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 11 07:04:31 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<sBiJJaNF1kdChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-11 07:06:06 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:55589: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.75
country_id: 1269750
description:
2025-12-11 07:06:28 dovecot_login authenticator failed for ([203.193.147.75]) [203.193.147.75]:57172: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-11 07:06:43 dovecot_login authenticator failed for ([182.95.229.38]) [182.95.229.38]:53922: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-11 07:06:58 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:52064: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-11 07:07:23 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:55006: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:41 host2 pure-ftpd[3139271]: (?@188.26.220.248) [INFO] New connection from 188.26.220.248


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:43 host2 sshd[3139268]: Invalid user ssvorof@epid.gov.lk from 188.26.220.248 port 50418


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.26.220.248
country_id: 2510769
description:
Dec 11 07:07:48 host2 pure-ftpd[3139271]: (?@188.26.220.248) [WARNING] Authentication failed for user [ssvorof@epid.gov.lk]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-11 07:07:54 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (nomin) [24.61.199.212]:55946: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-11 07:07:55 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:42987: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 11 07:10:03 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<+FJSOaNFDsWLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.74.133.70
country_id: 3374766
description:
2025-12-11 07:10:41 dovecot_plain authenticator failed for (tabodie) [41.74.133.70]:44625: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-11 07:10:42 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (throuses) [68.38.201.238]:37926: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-11 07:11:39 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:35630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-11 07:11:53 dovecot_login authenticator failed for (246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:40157: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-11 07:12:51 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:52620: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.64
country_id: 3996063
description:
2025-12-11 07:13:09 dovecot_login authenticator failed for (201.173.97.64-clientes-izzi.mx) [201.173.97.64]:51998: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-11 07:16:47 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (priliatify) [68.83.181.181]:56478: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-11 07:17:33 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:40862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-11 07:17:47 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:42072: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-11 07:19:10 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (bioness) [24.91.103.202]:41892: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:19:21 host2 sshd[3146949]: Disconnected from invalid user spark 103.179.56.33 port 51196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:19:27 host2 sshd[3146991]: Disconnected from invalid user wuhan 63.250.41.173 port 33938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:20:30 host2 sshd[3147725]: Disconnected from invalid user wuhan 138.124.20.112 port 34026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 11 07:21:23 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<3ZzaYaNF5h1ChJmA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:21:30 host2 sshd[3148284]: Disconnected from invalid user wzy 51.222.30.51 port 54436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:21:53 host2 sshd[3148754]: Disconnected from invalid user wzy 37.152.174.44 port 52146 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.192
country_id: 6252001
description:
Dec 11 07:22:18 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.192, lip=66.85.158.91, TLS, session=<e1MXZaNFGOuTuYTA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:22:37 host2 sshd[3149447]: Disconnected from invalid user server 51.222.30.51 port 53096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:24:29 host2 sshd[3152059]: Disconnected from invalid user ftpuser 63.250.41.173 port 40234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:23:40 host2 sshd[3150818]: Disconnected from invalid user dima 138.124.20.112 port 56142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:23:40 host2 sshd[3150841]: Disconnected from invalid user dima 37.152.174.44 port 57706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-11 07:25:26 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (turgatent) [174.169.224.27]:51218: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:24:33 host2 sshd[3152142]: Disconnected from invalid user 1 103.179.56.33 port 42736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Dec 11 07:24:52 host2 sshd[3152532]: Disconnected from invalid user sara 51.222.30.51 port 55764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:24:59 host2 sshd[3152690]: Disconnected from invalid user myuser 138.124.20.112 port 48296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.152.174.44
country_id: 130758
description:
Dec 11 07:25:03 host2 sshd[3152860]: Disconnected from invalid user anna 37.152.174.44 port 54748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.33
country_id: 1643084
description:
Dec 11 07:26:08 host2 sshd[3154518]: Disconnected from invalid user ubuntu 103.179.56.33 port 44338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.20.112
country_id: 798544
description:
Dec 11 07:26:57 host2 sshd[3155711]: Disconnected from invalid user liuyong 138.124.20.112 port 53004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:27:13 host2 sshd[3156291]: Disconnected from invalid user myuser 63.250.41.173 port 52286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-11 07:27:52 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:39714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:28:19 host2 sshd[3157651]: Received disconnect from 63.250.41.173 port 40380:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-11 07:28:24 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:41150: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 07:29:06 host2 sshd[3158648]: Disconnected from invalid user admin 2.57.121.112 port 20188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 63.250.41.173
country_id: 6252001
description:
Dec 11 07:29:58 host2 sshd[3159379]: Disconnected from invalid user sara 63.250.41.173 port 55980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-12-11 07:32:12 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:47631: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-12-11 07:32:30 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:57670: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 11 07:32:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, session=<k6koiqNFPnpBMQHe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.96.223.49
country_id: 2589581
description:
2025-12-11 07:33:28 dovecot_plain authenticator failed for (T8FWR3M6R) [105.96.223.49]:49622: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.96.223.49
country_id: 2589581
description:
2025-12-11 07:33:34 dovecot_login authenticator failed for (T8FWR3M6R) [105.96.223.49]:49622: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Dec 11 07:35:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.92, TLS, session=<TI3hlKNFru7G6xi3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.41
country_id: 3865483
description:
Dec 11 07:37:01 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.0.249.41, lip=66.85.158.91, TLS, session=<WWOGmKNF1cyzAPkp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-12-11 07:37:12 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:42129: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.69
country_id: 798544
description:
Dec 11 07:37:18 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.228.32.69, lip=66.85.158.91, TLS, session=<R4jGmaNFsN5b5CBF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-11 07:37:27 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:51035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-11 07:36:34 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:55476: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-11 07:38:09 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:56808: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2025-12-11 07:38:27 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:37727: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-11 07:37:39 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:35449: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-11 07:37:48 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:39408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-11 07:39:07 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:45700: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.165
country_id: 6252001
description:
Dec 11 07:41:30 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8q/IqaNFUM2TuYSl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-11 07:43:20 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:48490: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-11 07:42:34 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:38377: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-11 07:42:58 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:44918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-11 07:43:32 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:60373: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-11 07:45:21 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (cluadous) [71.235.225.181]:46608: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 11 07:49:25 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<m8YOxqNFprpChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-11 07:49:55 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (tuarbelead) [67.172.54.29]:60316: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-11 07:52:01 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:55797: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-11 07:52:04 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:44960: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-11 07:52:10 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:40282: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-11 07:52:21 dovecot_login authenticator failed for ([115.42.70.118]) [115.42.70.118]:52827: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-12-11 07:51:36 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:52756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-11 07:51:46 dovecot_login authenticator failed for ([182.79.87.18]) [182.79.87.18]:44756: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-11 07:51:50 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:49127: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-11 07:52:41 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:41594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-11 07:52:53 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:57479: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 07:53:50 dovecot_plain authenticator failed for (coble) [64.72.74.162]:55617: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 07:54:08 host2 sshd[3177122]: Disconnected from invalid user user 2.57.121.25 port 5959 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-11 07:56:25 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:60021: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-11 07:56:53 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:39256: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:00:18 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AWL+7KNFMNwjy9O6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-11 08:01:16 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:55655: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:00:41 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<b4Re7qNFKvwjy9O6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:01:46 host2 sshd[3182512]: Disconnected from invalid user user1 85.206.171.113 port 50842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-11 08:01:50 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:48696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-11 08:02:05 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:48167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-11 08:02:25 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:57985: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-11 08:01:40 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:40716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:02:47 host2 sshd[3183119]: Disconnected from invalid user robin 94.254.0.234 port 45990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:02:56 host2 sshd[3183176]: Disconnected from invalid user Azure 85.206.171.113 port 48518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-11 08:02:58 dovecot_plain authenticator failed for (fresm) [23.30.11.253]:43395: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.52
country_id: 6252001
description:
2025-12-11 08:03:08 dovecot_login authenticator failed for ([98.181.46.52]) [98.181.46.52]:51742: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-11 08:04:14 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:45008: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-11 08:04:01 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:38048: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:05:02 host2 sshd[3184878]: Disconnected from invalid user ubuntu 94.254.0.234 port 54550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Dec 11 08:05:37 host2 sshd[3185391]: Disconnected from invalid user celery 94.254.0.234 port 38468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 11 08:05:39 host2 sshd[3185416]: Disconnected from invalid user system 85.206.171.113 port 47454 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.186
country_id: 2635167
description:
Dec 11 08:05:47 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.186, lip=66.85.158.92, TLS, session=<lmiVAKRFCPYjy9O6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-11 08:06:53 dovecot_plain authenticator failed for (relferm) [65.20.149.93]:49151: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-11 08:07:04 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:38721: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-11 08:07:31 dovecot_login authenticator failed for ([149.54.15.90]) [149.54.15.90]:46299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-11 08:08:13 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:45726: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-11 08:08:29 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:61236: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-11 08:07:45 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:39062: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2025-12-11 08:08:09 dovecot_login authenticator failed for ([147.235.226.154]) [147.235.226.154]:53344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:10:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (tablowchic) [87.103.126.54]:14267: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-12-11 08:17:14 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:59380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-11 08:17:18 dovecot_plain authenticator failed for (melmocid) [85.29.149.211]:40222: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-11 08:16:54 dovecot_login authenticator failed for ([128.185.197.178]) [128.185.197.178]:60924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.196.139
country_id: 1227603
description:
[2025-12-11 08:18:41 +0530] info [cpaneld] 112.135.196.139 - fhbhealt "GET /assets/brand/favicon.ico HTTP/1.1" DEFERRED LOGIN cpaneld: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-11 08:21:24 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51854: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2025-12-11 08:21:41 dovecot_login authenticator failed for ([49.125.201.75]) [49.125.201.75]:34252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 08:21:51 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (cogra) [51.195.117.220]:34063: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-11 08:21:55 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (amells) [74.218.95.154]:46840: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-11 08:22:08 dovecot_plain authenticator failed for (sublechele) [91.73.195.150]:33702: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.248.172.86
country_id: 2328926
description:
[2025-12-11 08:24:26 +0530] info [webmaild] 23.248.172.86 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-12-11 08:25:38 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:60786: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-12-11 08:26:00 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:42354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-11 08:26:04 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:33740: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-11 08:26:22 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:53320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-11 08:27:06 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:41900: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-11 08:27:20 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:60058: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-11 08:27:22 dovecot_plain authenticator failed for (campted) [65.20.133.4]:41588: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-11 08:27:27 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (trades) [78.66.119.139]:45178: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:38 host2 sshd[3204754]: Invalid user ssvorof@epid.gov.lk from 103.188.87.245 port 61949


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:37 host2 pure-ftpd[3204753]: (?@103.188.87.245) [INFO] New connection from 103.188.87.245


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:28:44 host2 pure-ftpd[3204753]: (?@103.188.87.245) [WARNING] Authentication failed for user [ssvorof@epid.gov.lk]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:27:57 host2 sshd[3204298]: Disconnected from invalid user it 20.185.243.158 port 53542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:30:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (seption) [87.103.126.54]:58095: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:30:18 host2 sshd[3206471]: Disconnected from invalid user devops 101.47.162.254 port 58766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:29:52 host2 sshd[3205943]: Disconnected from invalid user test123 20.185.243.158 port 40172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.84.106
country_id: 1605651
description:
Dec 11 08:30:00 host2 sshd[3206058]: Disconnected from invalid user test123 49.228.84.106 port 50994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-11 08:31:39 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:33514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:31:41 host2 sshd[3207664]: Disconnected from invalid user himanshu 20.185.243.158 port 34206 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.188.87.245
country_id: 1694008
description:
Dec 11 08:31:47 host2 dovecot[2672093]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=103.188.87.245, lip=66.85.158.91, TLS handshaking, session=<eoqaXaRFlvtnvFf1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.30
country_id: 1733045
description:
2025-12-11 08:31:27 dovecot_login authenticator failed for ([49.124.151.30]) [49.124.151.30]:48856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-12-11 08:31:35 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:58827: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-11 08:32:42 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:34092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 11 08:32:55 host2 sshd[3208615]: Disconnected from invalid user gabriel 20.185.243.158 port 60462 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.206.227.180
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 185.206.227.180 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:34:13 host2 sshd[3209566]: Disconnected from invalid user gabriel 101.47.162.254 port 45608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.67.119
country_id: 6252001
description:
Dec 11 08:35:01 host2 sshd[3210087]: Disconnected from invalid user student 172.245.67.119 port 42636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:35:29 host2 sshd[3210575]: Disconnected from invalid user opsadmin 101.47.162.254 port 46760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.67.119
country_id: 6252001
description:
Dec 11 08:36:32 host2 sshd[3211239]: Disconnected from invalid user server 172.245.67.119 port 50980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 08:36:20 dovecot_plain authenticator failed for (appacenes) [64.72.74.162]:56764: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.45.177.42
country_id: 3865483
description:
Dec 11 08:36:52 host2 sshd[3211664]: Disconnected from invalid user webuser 181.45.177.42 port 54681 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 11 08:37:07 host2 sshd[3211835]: Disconnected from invalid user webuser 101.36.109.176 port 54600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 11 08:38:30 host2 sshd[3212747]: Disconnected from invalid user server 206.189.36.162 port 43632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:37:57 host2 sshd[3212398]: Disconnected from invalid user manoj 101.47.162.254 port 59774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.254
country_id: 1880251
description:
Dec 11 08:39:13 host2 sshd[3213157]: Disconnected from invalid user idempiere 101.47.162.254 port 53982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.238
country_id: 2300660
description:
Dec 11 08:39:20 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=41.139.44.238, lip=66.85.158.91, TLS, session=<oFN+d6RFoJ4piyzu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:39:25 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ZG7qeKRFluADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:39:35 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hlOAeaRF68Ijy9Ka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.246.11
country_id: 798544
description:
Dec 11 08:39:37 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=109.125.246.11, lip=66.85.158.91, TLS, session=<bBineKRFvKBtffYL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:40:24 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<6M5ifKRFsuAjy9Ka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:40:35 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<MCUSfaRFSMEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:40:55 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<cB1EfqRFKOQDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.176
country_id: 1819730
description:
Dec 11 08:41:03 host2 sshd[3214651]: Disconnected from invalid user pterodactyl 101.36.109.176 port 44700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-11 08:41:50 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:52013: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-11 08:42:04 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:57798: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:42:04 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VH5bgqRFyu0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-11 08:42:08 dovecot_login authenticator failed for ([118.39.230.40]) [187.58.66.231]:41265: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-11 08:42:48 dovecot_login authenticator failed for ([49.124.151.82]) [38.148.95.217]:39425: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 08:41:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (punalsing) [87.103.126.54]:55405: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:42:52 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Dqk6haRF2J4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:44:01 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LMdTiaRFnMcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:45:14 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<S964jaRFSLMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-11 08:45:26 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:44696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.188
country_id: 3996063
description:
2025-12-11 08:45:38 dovecot_login authenticator failed for ([177.239.164.188]) [177.239.164.188]:39536: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:45:53 host2 dovecot[2672093]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<mwULkKRFRMUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:46:24 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<X5fckaRFtOgDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-11 08:47:37 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:41995: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-11 08:47:50 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:44202: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:47:03 host2 dovecot[2672093]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=</P4ylKRFjMADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:47:17 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<xKADlaRF/OsDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-11 08:47:20 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:46938: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.21
country_id: 3996063
description:
2025-12-11 08:47:26 dovecot_login authenticator failed for (187.161.173.21-clientes-izzi.mx) [187.161.173.21]:43071: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.154
country_id: 2635167
description:
Dec 11 08:47:32 host2 dovecot[2672093]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.154, lip=66.85.158.91, TLS, session=<G2HslaRFqu4jy9Ka>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-11 08:47:53 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:53248: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-11 08:48:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:58724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.45.177.42
country_id: 3865483
description:
Dec 11 08:48:19 host2 sshd[3222030]: Disconnected from invalid user server 181.45.177.42 port 65078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 11 08:48:27 host2 dovecot[2672093]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<axUtmaRFnukDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 08:50:39 host2 sshd[3224036]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2025-12-11 08:50:09 dovecot_login authenticator failed for ([69.165.78.31]) [69.165.78.31]:48030: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-11 08:50:18 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:42204: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.100
country_id: 6252001
description:
2025-12-11 08:50:37 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:35614: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-11 08:50:39 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:49546: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-11 08:50:55 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:56162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-11 08:51:18 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:42668: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-11 08:51:55 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:42972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-11 08:56:07 dovecot_login authenticator failed for ([152.70.157.25]) [152.70.157.25]:35552: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-11 08:56:18 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:44462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 08:56:39 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (untgeness) [51.195.117.220]:25054: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-11 08:56:57 dovecot_login authenticator failed for ([125.20.231.225]) [128.185.231.6]:38410: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-11 08:57:28 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:44320: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-11 08:58:39 dovecot_plain authenticator failed for (reekness) [154.146.240.123]:38136: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 08:58:52 host2 sshd[3229852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-11 08:59:40 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:39752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-11 08:59:12 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:55366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-11 08:59:19 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-11 08:59:38 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (unwigast) [98.192.74.183]:33646: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Dec 11 09:01:52 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.61, lip=66.85.158.91, TLS: Connection closed, session=<Yoo1yaRFQBSnXpI9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.100.104
country_id: 798544
description:
Dec 11 09:03:52 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.219.100.104, lip=66.85.158.91, TLS, session=<MBpez6RFAMGy22Ro>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.223
country_id: 3865483
description:
Dec 11 09:04:14 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.223, lip=66.85.158.91, TLS, session=<BAl+0KRF56CzAPrf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-11 09:05:48 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:35986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-11 09:06:06 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:58774: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.255.103.194
country_id: 1819730
description:
Dec 11 09:07:16 host2 sshd[3236763]: Disconnected from invalid user new 218.255.103.194 port 38528 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.9.129
country_id: 3469034
description:
[2025-12-11 09:09:32 +0530] info [cpaneld] 207.248.9.129 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-11 09:09:37 dovecot_plain authenticator failed for (enece) [65.20.143.159]:52743: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.50
country_id: 6252001
description:
2025-12-11 09:09:54 dovecot_login authenticator failed for ([98.181.46.50]) [98.181.46.50]:48229: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-11 09:10:21 dovecot_login authenticator failed for ([125.19.171.126]) [152.52.197.174]:56518: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:12:57 host2 sshd[3241452]: Disconnected from invalid user ts 154.90.59.75 port 45916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-11 09:14:27 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:54660: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-11 09:14:34 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:34770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-11 09:14:46 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:15:02 host2 sshd[3242984]: Disconnected from invalid user wireguard 154.90.59.75 port 48662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.72.17.43
country_id: 2750405
description:
2025-12-11 09:15:38 dovecot_login authenticator failed for ([77.72.17.43]) [77.72.17.43]:51448: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-11 09:15:56 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:36314: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Dec 11 09:16:32 host2 sshd[3244160]: Disconnected from invalid user alex 154.90.59.75 port 43410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-11 09:18:34 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:48772: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-11 09:19:04 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:45989: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-12-11 09:19:12 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:59994: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-11 09:19:42 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:60067: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-11 09:20:09 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:49608: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.47
country_id: 1733045
description:
2025-12-11 09:20:32 dovecot_login authenticator failed for ([49.124.149.47]) [49.124.149.47]:50706: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-11 09:21:04 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:45360: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-11 09:21:20 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:63631: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.165.154.155
country_id: 1643084
description:
2025-12-11 09:21:27 dovecot_plain authenticator failed for ([89.116.164.85]) [125.165.154.155]:12288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.190.52.108
country_id: 298795
description:
2025-12-11 09:21:42 dovecot_plain authenticator failed for ([89.116.164.85]) [78.190.52.108]:61110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-11 09:21:43 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (gridae) [73.161.96.107]:57378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.76.134
country_id: 1269750
description:
2025-12-11 09:21:57 dovecot_plain authenticator failed for ([89.116.164.85]) [182.77.76.134]:3146: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:23:37 host2 sshd[3249051]: Disconnected from invalid user testuser 109.122.251.178 port 39676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:24:45 host2 sshd[3249809]: Disconnected from invalid user rf 109.122.251.178 port 39776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.122.251.178
country_id: 130758
description:
Dec 11 09:25:17 host2 sshd[3250319]: Disconnected from invalid user mami 109.122.251.178 port 39824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:26:33 host2 sshd[3251410]: Disconnected from invalid user ubuntu 152.32.135.217 port 60210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:27:49 host2 sshd[3252574]: Disconnected from invalid user TEST 152.32.135.217 port 52038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.135.217
country_id: 1819730
description:
Dec 11 09:27:10 host2 sshd[3252066]: Disconnected from invalid user zain 152.32.135.217 port 41956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-11 09:28:03 dovecot_plain authenticator failed for (undick) [91.73.195.150]:40945: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:28:28 host2 sshd[3253016]: Disconnected from invalid user consultor 103.179.56.78 port 57442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:28:34 host2 sshd[3253090]: Disconnected from invalid user kt 124.18.141.70 port 34266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:28:47 host2 sshd[3253181]: Disconnected from invalid user yzx 186.103.169.12 port 58172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-11 09:27:58 dovecot_plain authenticator failed for (trazzary) [41.248.243.181]:57120: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:29:43 host2 sshd[3253785]: Disconnected from invalid user samp 118.193.61.63 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:29:18 host2 sshd[3253536]: Disconnected from invalid user rf 103.179.56.78 port 37298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.78
country_id: 1643084
description:
Dec 11 09:30:11 host2 sshd[3254254]: Disconnected from invalid user TEST 103.179.56.78 port 53988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:30:22 host2 sshd[3254386]: Disconnected from invalid user es 118.193.61.63 port 16136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-11 09:30:01 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (wavicliker) [73.145.107.251]:46066: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:31:05 host2 sshd[3254801]: Disconnected from invalid user demo 118.193.61.63 port 28742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Dec 11 09:31:54 host2 sshd[3255329]: Disconnected from invalid user deploy 118.193.61.63 port 41350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:32:06 host2 sshd[3255485]: Disconnected from invalid user lisa 124.18.141.70 port 52254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.230
country_id: 1819730
description:
Dec 11 09:32:16 host2 sshd[3255556]: Disconnected from invalid user server 103.243.26.230 port 45508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:33:22 host2 sshd[3256147]: Disconnected from invalid user frappe 124.18.141.70 port 35714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.230
country_id: 1819730
description:
Dec 11 09:33:33 host2 sshd[3256248]: Disconnected from invalid user lisa 103.243.26.230 port 44818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:33:14 host2 sshd[3256062]: Disconnected from invalid user pz 186.103.169.12 port 39908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-11 09:34:29 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:41666: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:34:44 host2 sshd[3256919]: Disconnected from invalid user ricardo 186.103.169.12 port 60176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.18.141.70
country_id: 1861060
description:
Dec 11 09:36:17 host2 sshd[3258350]: Disconnected from invalid user erpnext 124.18.141.70 port 50920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-11 09:36:22 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (overiers) [71.235.225.181]:48846: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 09:36:28 dovecot_plain authenticator failed for (pativers) [102.53.15.18]:45571: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:36:14 host2 sshd[3258299]: Disconnected from invalid user lisa 186.103.169.12 port 39872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Dec 11 09:37:52 host2 sshd[3259440]: Disconnected from invalid user frappe 186.103.169.12 port 55776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-12-11 09:38:49 dovecot_plain authenticator failed for (ephosts) [80.227.147.94]:53972: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-11 09:39:32 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se [85.225.19.144]:54887: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2025-12-11 09:39:31 dovecot_login authenticator failed for (51-170-97-62.cust.smartcall.no) [62.97.170.51]:34154: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-11 09:39:19 dovecot_login authenticator failed for (187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:54149: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.156
country_id: 6252001
description:
2025-12-11 09:39:21 dovecot_login authenticator failed for ([98.185.120.156]) [98.185.120.156]:43455: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.200
country_id: 3469034
description:
Dec 11 09:40:15 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=138.255.206.200, lip=66.85.158.91, TLS, session=<+YxgUaVFfNWK/87I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-11 09:40:22 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:37712: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.114
country_id: 3469034
description:
Dec 11 09:40:40 host2 dovecot[2672093]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=190.89.137.114, lip=66.85.158.91, TLS, session=<IDenUqVFLMu+WYly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-11 09:40:48 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:57497: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-11 09:42:18 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (unaggic) [68.82.141.145]:44018: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:42:27 host2 sshd[3262775]: Disconnected from invalid user homeassistant 138.68.150.253 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:44:22 host2 sshd[3264241]: Disconnected from invalid user user14 27.50.25.190 port 37402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:44:36 host2 sshd[3264471]: Disconnected from invalid user amalia 138.68.150.253 port 42334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-11 09:45:17 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:51770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:46:15 host2 sshd[3266903]: Disconnected from invalid user www-data 27.50.25.190 port 58594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-11 09:46:25 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:35832: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:46:40 host2 sshd[3267401]: Disconnected from invalid user consultor 138.68.150.253 port 38410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-11 09:46:11 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:57378: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:47:45 host2 sshd[3268768]: Disconnected from invalid user hydra 138.68.150.253 port 33166 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:47:15 host2 sshd[3268278]: Received disconnect from 138.68.150.253 port 37006:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:48:14 host2 sshd[3269169]: Disconnected from invalid user deployer 27.50.25.190 port 41498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 11 09:48:16 host2 sshd[3269188]: Disconnected from invalid user www-data 138.68.150.253 port 34654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.50.25.190
country_id: 1643084
description:
Dec 11 09:49:33 host2 sshd[3270046]: Disconnected from invalid user hydra 27.50.25.190 port 40980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-11 09:51:11 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (reprel) [81.243.106.218]:49496: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:52:14 host2 sshd[3272599]: Disconnected from invalid user dev 190.0.63.226 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 09:53:19 host2 sshd[3273296]: Disconnected from invalid user admin 2.57.121.112 port 30544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:53:31 host2 sshd[3273398]: Disconnected from invalid user shubham 190.0.63.226 port 34544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:52:53 host2 sshd[3273041]: Disconnected from invalid user vpn 190.0.63.226 port 49912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:54:11 host2 sshd[3274132]: Disconnected from invalid user isaac 190.0.63.226 port 47418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 09:55:23 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:60094: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 11 09:55:27 host2 sshd[3275156]: Disconnected from invalid user cma 190.0.63.226 port 44924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 09:55:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50771: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 09:56:43 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (rinitelly) [217.215.74.195]:57929: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-11 09:58:51 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:42534: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-11 09:59:27 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:46898: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-12-11 10:03:52 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:1811: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-11 10:03:59 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:49302: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-11 10:04:14 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:44495: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.205.166
country_id: 953987
description:
2025-12-11 10:04:14 dovecot_login authenticator failed for ([197.90.205.166]) [197.90.205.166]:46061: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-11 10:05:14 dovecot_login authenticator failed for (201.173.216.120-clientes-izzi.mx) [201.173.216.120]:47097: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2025-12-11 10:05:38 dovecot_login authenticator failed for ([49.124.151.70]) [49.124.151.70]:57690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-11 10:07:54 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (diaticam) [67.173.58.47]:46138: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:08:29 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (rhyped) [51.195.117.220]:24638: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-12-11 10:10:04 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:59500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-11 10:10:18 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:47808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-11 10:10:31 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:36886: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-12-11 10:09:52 dovecot_login authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:56535: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Dec 11 10:10:57 host2 sshd[3288990]: Disconnected from invalid user slurm 196.196.253.20 port 39958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.198.253
country_id: 1210997
description:
Dec 11 10:11:13 host2 sshd[3289217]: Disconnected from invalid user root2 103.86.198.253 port 57224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-11 10:12:26 dovecot_plain authenticator failed for (pusly) [65.20.149.93]:50704: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Dec 11 10:16:20 host2 dovecot[3293386]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 112.135.221.7
country_id: 1227603
description:
[2025-12-11 10:16:29 +0530] info [cpaneld] 112.135.221.7 NEW fhbhealt:DFXIiO8iJcxbd5tX address=112.135.221.7,app=cpaneld,creator=fhbhealt,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.221.7
country_id: 1227603
description:
[2025-12-11 10:16:44 +0530] info [cpaneld] 112.135.221.7 - fhbhealt "GET /cpsess0568280221/frontend/jupiter/resource_usage/resource_usage.live.pl HTTP/1.1" DEFERRED LOGIN cpaneld: security token incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:16:59 host2 sshd[3294171]: Disconnected from invalid user postgres 45.78.230.231 port 49818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-11 10:20:12 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:55074: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-11 10:23:14 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:43690: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-11 10:23:29 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:34731: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-11 10:23:35 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:41299: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-11 10:23:46 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:38587: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:23:48 host2 sshd[3299508]: Disconnected from invalid user luz 45.78.230.231 port 35234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-11 10:24:12 dovecot_plain authenticator failed for (noxaters) [96.85.104.2]:58948: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:27:19 host2 sshd[3301866]: Disconnected from invalid user ubuntu 45.78.230.231 port 57804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:27:01 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (kantrapy) [51.195.117.220]:43461: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-11 10:28:14 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:48994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.231
country_id: 1880251
description:
Dec 11 10:28:28 host2 sshd[3302453]: Disconnected from invalid user ftpuser 45.78.230.231 port 53880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-11 10:27:55 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:54742: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-11 10:29:17 dovecot_login authenticator failed for (static.92.254.104.190.cps.com.ar) [190.104.254.91]:41273: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-11 10:29:22 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (aniter) [73.195.211.98]:59486: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-12-11 10:29:25 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:55674: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 10:29:26 dovecot_plain authenticator failed for (danizedrid) [64.72.74.162]:38058: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-11 10:29:38 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (theclicase) [98.227.25.115]:33468: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-11 10:29:39 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:57331: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 10:32:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (hemon) [87.103.126.54]:17973: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-11 10:34:50 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:33183: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-11 10:33:59 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:63295: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-11 10:34:24 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:43480: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 10:34:38 host2 sshd[3306322]: Disconnected from invalid user user 2.57.121.25 port 24670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-11 10:35:05 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:61217: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-11 10:37:50 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (wherreas) [2.135.31.74]:39349: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Dec 11 10:37:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.92, TLS: Connection closed, session=<57W+H6ZFWOnLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-12-11 10:41:11 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:50638: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-11 10:41:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:43657: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.45
country_id: 1269750
description:
Dec 11 10:43:18 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.18.166.45, lip=66.85.158.91, TLS, session=<MmHFMqZFYrRnEqYt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.190
country_id: 3175395
description:
Dec 11 10:43:35 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.63.132.190, lip=66.85.158.91, TLS, session=<t0v5M6ZFE5e5P4S+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 10:44:45 host2 sshd[3316157]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-11 10:44:28 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:35872: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-11 10:44:42 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:45136: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:48:06 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (dentenan) [51.195.117.220]:58412: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-11 10:48:35 dovecot_plain authenticator failed for (unden) [109.226.14.93]:34399: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-11 10:48:39 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:52760: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-11 10:49:02 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:36218: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 10:52:59 host2 sshd[3323369]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-11 10:53:22 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:45920: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-11 10:53:51 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:58791: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-11 10:53:50 dovecot_login authenticator failed for ([105.73.93.110]) [105.73.93.110]:60017: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 10:54:10 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:20167: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-11 10:55:06 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:47957: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2025-12-11 10:55:23 dovecot_login authenticator failed for ([49.124.159.186]) [49.124.159.186]:33812: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-12-11 10:56:46 +0530] info [cpaneld] 54.37.131.169 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.90
country_id: 3175395
description:
Dec 11 10:59:10 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.170.90, lip=66.85.158.91, TLS, session=<3uVsa6ZFJaq5D6pa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.70.70
country_id: 3996063
description:
Dec 11 10:59:27 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.70.70, lip=66.85.158.91, TLS, session=<JXu6bKZFTKzJqEZG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-11 10:59:30 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:40857: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-11 10:59:42 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:54270: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-11 11:00:11 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:44326: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.37
country_id: 1733045
description:
2025-12-11 11:01:10 dovecot_login authenticator failed for ([49.124.146.37]) [49.124.146.37]:50016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-12-11 11:02:40 dovecot_plain authenticator failed for vps-f9a28e39.vps.ovh.net (brotord) [51.195.117.220]:23946: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 112.135.182.112
country_id: 1227603
description:
[2025-12-11 11:04:46 +0530] info [cpaneld] 112.135.182.112 - fhbhealt "GET /cpsess1318739637/frontend/jupiter/index.html?=undefined&login=1&post_login=81245659505391 HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [112.135.221.7] != Current IP Address [112.135.182.112]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 11:08:33 host2 sshd[3335070]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-11 11:09:36 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:48328: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-11 11:10:23 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:36626: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 11:11:27 host2 sshd[3336848]: Disconnected from invalid user admin 2.57.121.112 port 50279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-11 11:13:43 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:43401: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.228
country_id: 6252001
description:
Dec 11 11:16:08 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.228, lip=66.85.158.91, TLS, session=<T71iqaZF0vrN0h/k>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-12-11 11:18:35 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:60386: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-11 11:18:36 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:51778: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-11 11:19:37 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:48342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-11 11:19:48 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:46318: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-12-11 11:18:55 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:35100: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-11 11:18:55 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:57061: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.171
country_id: 1733045
description:
2025-12-11 11:24:17 dovecot_login authenticator failed for ([49.124.154.171]) [49.124.154.171]:55308: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-11 11:24:43 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:55084: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 11:25:34 host2 sshd[3346865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-11 11:25:06 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:64325: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-11 11:25:28 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:56426: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 11:26:46 host2 sshd[3347501]: Disconnected from invalid user admin 2.57.121.112 port 25209 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-11 11:27:48 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:60726: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-11 11:27:30 dovecot_login authenticator failed for ([80.88.102.128]) [80.88.102.128]:53448: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-11 11:27:54 dovecot_plain authenticator failed for (tagreed) [65.20.148.194]:45521: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 11:32:55 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (scatigion) [87.103.126.54]:17341: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-11 11:34:41 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:45010: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-11 11:35:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:53152: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 11:35:27 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (nestraunce) [96.230.65.90]:57086: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-11 11:35:12 dovecot_plain authenticator failed for (habled) [149.62.239.4]:57314: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.20.11
country_id: 6252001
description:
Dec 11 11:36:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.20.11, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Uoot8qZFstanrBQL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-11 11:38:07 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:57456: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.60
country_id: 6252001
description:
2025-12-11 11:38:25 dovecot_login authenticator failed for ([98.185.120.60]) [98.185.120.60]:43050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-11 11:42:48 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (hoding) [73.13.220.220]:35992: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-11 11:43:15 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:51422: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-11 11:43:32 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:49356: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-11 11:43:00 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:42594: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-11 11:43:13 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:50532: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-11 11:44:17 dovecot_login authenticator failed for c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:37243: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-11 11:44:29 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:47387: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-12-11 11:45:26 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:42826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-11 11:45:33 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (cotess) [68.60.77.128]:54558: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-11 11:45:48 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:53397: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-11 11:49:43 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:10180: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-11 11:49:09 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:44567: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-11 11:49:41 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:56878: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-11 11:50:13 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:44485: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-11 11:50:16 dovecot_plain authenticator failed for (adjuddlia) [92.62.243.174]:40881: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-11 11:50:21 dovecot_plain authenticator failed for (pilented) [102.53.15.180]:42830: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 11:54:04 host2 sshd[3365861]: Disconnected from invalid user user 2.57.121.25 port 40921 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.242
country_id: 1733045
description:
2025-12-11 11:59:16 dovecot_login authenticator failed for ([49.124.152.242]) [49.124.152.242]:48434: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-11 11:59:34 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:54075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.146.143
country_id: 690791
description:
Dec 11 12:02:33 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.146.143, lip=66.85.158.91, TLS, session=<tp1bTqdF3akl3ZKP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2025-12-11 12:03:27 dovecot_login authenticator failed for 133.232.78.150.static.zoot.jp ([125.19.174.244]) [133.232.78.150]:33206: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.225
country_id: 1269750
description:
Dec 11 12:03:41 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.59.134.225, lip=66.85.158.91, TLS, session=<Pd9UUqdFUYJnO4bh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.16
country_id: 732800
description:
Dec 11 12:03:40 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.255.215.16, lip=66.85.158.91, TLS, session=<dTBhUqdF9Ym5/9cQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.124
country_id: 732800
description:
Dec 11 12:02:51 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.255.215.124, lip=66.85.158.91, TLS, session=<duFyT6dF16S5/9d8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-11 12:02:54 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:41670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-11 12:03:21 dovecot_login authenticator failed for ([70.174.167.153]) [70.174.167.153]:34086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.57
country_id: 953987
description:
Dec 11 12:04:03 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=102.64.43.57, lip=66.85.158.91, TLS, session=<k3WMU6dFdKlmQCs5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.54
country_id: 3658394
description:
Dec 11 12:04:12 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=201.182.148.54, lip=66.85.158.91, TLS, session=<Pwk2VKdFxZzJtpQ2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.162.20.240
country_id: 3865483
description:
Dec 11 12:04:15 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=45.162.20.240, lip=66.85.158.91, TLS, session=<x1ZLVKdFwpktohTw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.14
country_id: 953987
description:
Dec 11 12:03:53 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.59.14, lip=66.85.158.91, TLS, session=<NC/iUqdFd+xmgTsO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.215
country_id: 3865483
description:
Dec 11 12:03:53 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=190.181.101.215, lip=66.85.158.91, TLS, session=<+dzuUqdFp8G+tWXX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.62
country_id: 798544
description:
Dec 11 12:03:58 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=128.127.94.62, lip=66.85.158.91, TLS, session=<cfJvU6dF+cKAf14+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 11 12:06:52 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LpvNXqdF1NhChJl9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:07:41 host2 sshd[3376869]: Disconnected from invalid user kian 154.91.90.27 port 34936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 12:07:47 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:37632: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-11 12:07:57 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:54553: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.23
country_id: 1733045
description:
2025-12-11 12:08:13 dovecot_login authenticator failed for ([49.124.151.23]) [49.124.151.23]:46874: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-11 12:08:24 dovecot_login authenticator failed for (cm-84.215.110.96.get.no) [84.215.110.96]:54517: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:08:27 host2 sshd[3377290]: Disconnected from invalid user alexis 154.91.90.27 port 58460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2025-12-11 12:08:54 dovecot_login authenticator failed for dsl-212-135-208-13.dsl.easynet.co.uk [212.135.208.13]:43863: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-11 12:09:10 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:42920: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:09:09 host2 sshd[3377722]: Disconnected from invalid user ubuntu 154.91.90.27 port 54884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:10:35 host2 sshd[3378801]: Disconnected from invalid user issabel 154.91.90.27 port 41188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.90.27
country_id: 1880251
description:
Dec 11 12:11:58 host2 sshd[3379653]: Disconnected from invalid user vpnuser 154.91.90.27 port 58004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:18:13 host2 sshd[3385069]: Disconnected from invalid user brandon 150.5.169.176 port 59054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:23:01 host2 sshd[3389234]: Disconnected from invalid user eva 150.5.169.176 port 48708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.2.118.205
country_id: 3865483
description:
2025-12-11 12:23:05 dovecot_plain authenticator failed for ([89.116.164.85]) [190.2.118.205]:53582: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.66.142.244
country_id: 1694008
description:
2025-12-11 12:22:41 dovecot_plain authenticator failed for ([89.116.164.85]) [103.66.142.244]:39992: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.164.152.143
country_id: 6252001
description:
2025-12-11 12:22:53 dovecot_plain authenticator failed for 47-164-152-143.bng03.brpt.ct.frontiernet.net ([89.116.164.85]) [47.164.152.143]:36802: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-11 12:23:47 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:48858: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2025-12-11 12:24:08 dovecot_login authenticator failed for (abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:43930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-11 12:25:33 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50433: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.14
country_id: 1733045
description:
2025-12-11 12:25:44 dovecot_login authenticator failed for ([49.124.153.14]) [49.124.153.14]:60632: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-11 12:25:56 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:39657: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-12-11 12:26:06 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:56926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-11 12:26:11 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:33342: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-11 12:26:20 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:58230: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:26:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (flaterious) [87.103.126.54]:63884: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-11 12:26:50 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:33902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-11 12:27:09 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:56079: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-11 12:27:52 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:60096: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 11 12:28:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<6GoOrKdFLtTCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-11 12:27:39 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:42198: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:27:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (isemilie) [87.103.126.54]:30588: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 11 12:28:58 host2 sshd[3394512]: Disconnected from invalid user samba 150.5.169.176 port 57884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 12:30:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (meter) [87.103.126.54]:13665: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-12-11 12:31:15 dovecot_plain authenticator failed for (comialy) [46.35.178.104]:58290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-11 12:32:20 dovecot_login authenticator failed for (broadband.actcorp.in) [49.204.232.244]:48034: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-11 12:32:30 dovecot_plain authenticator failed for (culituade) [154.144.243.93]:52858: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-11 12:32:32 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:49338: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.240.121
country_id: 3144096
description:
2025-12-11 12:32:12 dovecot_login authenticator failed for (cm-178.232.240.121.get.no) [178.232.240.121]:38720: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-11 12:32:42 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56418: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.96
country_id: 3865483
description:
Dec 11 12:33:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.250.96, lip=66.85.158.91, TLS, session=<PjwKvadF0tOzAPpg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.154
country_id: 953987
description:
Dec 11 12:33:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=102.129.62.154, lip=66.85.158.91, TLS, session=<MiGEvqdFabdmgT6a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-11 12:34:18 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:54781: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.60
country_id: 1733045
description:
2025-12-11 12:34:35 dovecot_login authenticator failed for ([49.124.151.60]) [49.124.151.60]:49346: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-11 12:37:01 dovecot_plain authenticator failed for (tupectid) [64.72.74.162]:35043: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-11 12:38:25 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:40012: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-12-11 12:37:59 dovecot_login authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:56422: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 12:39:09 host2 sshd[3402422]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.84.106.161
country_id: 3469034
description:
2025-12-11 12:38:37 dovecot_plain authenticator failed for 170-84-106-161-as265023.tmkultra.net.br ([192.168.1.2]) [170.84.106.161]:33897: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-11 12:38:54 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:49556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-11 12:39:14 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:55048: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 12:43:34 host2 sshd[3406383]: Disconnected from invalid user admin 2.57.121.112 port 17488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 11 12:43:40 host2 sshd[3406467]: Disconnected from invalid user monitor 158.69.204.92 port 42002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 12:45:49 host2 sshd[3408111]: Disconnected from invalid user  62.60.131.157 port 11715 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 12:47:28 host2 sshd[3409798]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 11 12:46:34 host2 sshd[3408967]: Disconnected from invalid user mark 51.83.71.110 port 41694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 11 12:46:42 host2 sshd[3409017]: Disconnected from invalid user user 158.69.204.92 port 58682 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 11 12:46:49 host2 pure-ftpd[3409135]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 11 12:47:11 host2 sshd[3409385]: Disconnected from invalid user infoserve 103.88.76.27 port 56346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 11 12:48:26 host2 sshd[3410802]: Disconnected from invalid user syncuser 158.69.204.92 port 50612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 11 12:48:30 host2 sshd[3410847]: Disconnected from invalid user valentin 45.55.249.98 port 41080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 11 12:47:48 host2 sshd[3410084]: Disconnected from invalid user smart 51.83.71.110 port 53374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-11 12:48:07 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:52754: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-11 12:48:25 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:46828: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-11 12:49:03 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (rancht) [73.213.237.28]:41080: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Dec 11 12:49:24 host2 sshd[3411899]: Disconnected from invalid user debian 51.83.71.110 port 40262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 11 12:49:30 host2 sshd[3411976]: Disconnected from invalid user smart 158.69.204.92 port 46714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-11 12:48:40 dovecot_login authenticator failed for ([183.171.12.224]) [77.89.143.122]:42533: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 11 12:50:07 host2 sshd[3412579]: Disconnected from invalid user arvind 103.88.76.27 port 34608 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 12:51:08 host2 sshd[3413559]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 11 12:50:42 host2 sshd[3413154]: Disconnected from invalid user www-data 45.55.249.98 port 57912 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 11 12:51:07 host2 sshd[3413550]: Disconnected from invalid user raul 158.69.204.92 port 60348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-11 12:52:30 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:47206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 11 12:51:45 host2 sshd[3414063]: Received disconnect from 45.55.249.98 port 41082:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 11 12:51:45 host2 sshd[3414063]: Disconnected from invalid user monitor 45.55.249.98 port 41082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.16
country_id: 1733045
description:
2025-12-11 12:52:16 dovecot_login authenticator failed for ([49.124.153.16]) [49.124.153.16]:59162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 11 12:52:49 host2 sshd[3415294]: Disconnected from invalid user sam 103.88.76.27 port 46006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 11 12:53:22 host2 sshd[3415699]: Disconnected from invalid user syncuser 45.55.249.98 port 35628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-11 12:56:02 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (murimed) [174.59.253.88]:56302: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-11 12:57:14 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:53162: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-11 12:57:23 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:40552: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-11 12:56:46 dovecot_plain authenticator failed for (flatibam) [24.187.213.29]:44530: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-12-11 12:57:00 dovecot_login authenticator failed for ([182.95.22.224]) [27.123.104.158]:59316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-11 12:57:04 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:53092: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-11 12:58:32 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:48723: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-11 12:58:21 dovecot_login authenticator failed for ([113.203.205.37]) [113.203.205.37]:41928: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-12-11 13:03:00 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:39161: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.108.138
country_id: 1269750
description:
2025-12-11 13:02:46 dovecot_login authenticator failed for ([182.76.36.105]) [182.78.108.138]:35566: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.51.218.16
country_id: 2510769
description:
2025-12-11 13:03:38 dovecot_login authenticator failed for 16.red-83-51-218.dynamicip.rima-tde.net [83.51.218.16]:55579: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 11 13:03:38 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<dJjSKahFyMxChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2025-12-11 13:03:58 dovecot_login authenticator failed for ([49.124.149.204]) [49.124.149.204]:32944: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-11 13:07:16 dovecot_plain authenticator failed for (conaffic) [65.20.133.208]:36683: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.153
country_id: 1269750
description:
Dec 11 13:08:19 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.18.166.153, lip=66.85.158.91, TLS, session=<Kf5sOahFnaxnEqaZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 11 13:08:36 host2 sshd[3426054]: Disconnected from invalid user user01 154.91.170.52 port 54372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.176
country_id: 3469034
description:
Dec 11 13:09:01 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.96.176, lip=66.85.158.91, TLS, session=<cZbrO6hF3oyxLGCw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 11 13:09:41 host2 sshd[3427066]: Disconnected from invalid user ubuntu 154.91.170.52 port 51568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 11 13:10:05 host2 sshd[3427586]: Disconnected from invalid user oliver 201.184.50.251 port 42586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 11 13:11:26 host2 sshd[3428544]: Disconnected from invalid user was 201.184.50.251 port 42812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 11 13:12:05 host2 sshd[3429142]: Disconnected from invalid user mango 201.184.50.251 port 57030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 11 13:13:05 host2 sshd[3429946]: Disconnected from invalid user test 154.91.170.52 port 52988 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-12-11 13:13:20 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:49063: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 11 13:13:28 host2 sshd[3430210]: Disconnected from invalid user cms 201.184.50.251 port 57240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-11 13:12:42 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:55283: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 11 13:13:40 host2 sshd[3430399]: Disconnected from invalid user dinesh 154.91.170.52 port 49648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Dec 11 13:14:15 host2 sshd[3430827]: Disconnected from invalid user sshuser 154.91.170.52 port 55848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:14:47 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ktKwUahFPLMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.235.7.1
country_id: 3077311
description:
2025-12-11 13:14:46 dovecot_plain authenticator failed for customer7-1.airweb.cz (exidall) [109.235.7.1]:34349: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-11 13:14:48 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (toglougly) [174.169.224.27]:58908: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-11 13:16:25 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:56824: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-11 13:16:29 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (ablack) [98.204.134.124]:37062: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:19:05 host2 dovecot[3293415]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ZqALYahFmNwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:19:33 host2 dovecot[3293415]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VwDCYqhFUssDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-11 13:21:08 dovecot_login authenticator failed for (static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:47699: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-11 13:21:11 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:37376: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-11 13:21:21 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:56324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-11 13:21:28 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (horcete) [73.53.254.168]:48770: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-11 13:21:39 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:58271: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.73.75.82
country_id: 174982
description:
2025-12-11 13:22:27 dovecot_login authenticator failed for ([212.73.75.82]) [212.73.75.82]:38575: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-11 13:22:40 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:52855: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-11 13:23:07 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:51012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:23:17 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<sGEZcKhFiJUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:23:38 host2 dovecot[3293415]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<CgBPcahFKOADiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.133.197.227
country_id: 6252001
description:
[2025-12-11 13:25:09 +0530] info [whostmgrd] 72.133.197.227 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:25:20 host2 dovecot[3293415]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<zP9kd6hFLOIDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-11 13:26:29 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41178: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-11 13:26:54 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:36521: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-11 13:27:07 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:53470: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-11 13:27:30 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:40771: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-11 13:27:57 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:55819: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.201.118.225
country_id: 3895114
description:
2025-12-11 13:28:01 dovecot_plain authenticator failed for ([89.116.164.85]) [128.201.118.225]:54308: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-11 13:28:17 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:34462: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.153.47.105
country_id: 6252001
description:
2025-12-11 13:28:20 dovecot_plain authenticator failed for c-76-153-47-105.hsd1.fl.comcast.net ([89.116.164.85]) [76.153.47.105]:50543: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 13:30:29 host2 sshd[3445340]: Disconnected from invalid user  62.60.131.157 port 58275 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.233.216.107
country_id: 3469034
description:
2025-12-11 13:32:20 dovecot_plain authenticator failed for ([89.116.164.85]) [45.233.216.107]:18356: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.36.225
country_id: 290557
description:
2025-12-11 13:32:35 dovecot_plain authenticator failed for ([89.116.164.85]) [91.74.36.225]:41560: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.59.242.21
country_id: 1522867
description:
2025-12-11 13:32:49 dovecot_plain authenticator failed for 95.59.242.21.dynamic.telecom.kz ([89.116.164.85]) [95.59.242.21]:51138: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.9
country_id: 6252001
description:
2025-12-11 13:33:22 dovecot_login authenticator failed for ([98.185.120.9]) [98.185.120.9]:38460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-11 13:33:44 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:41356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.104
country_id: 6252001
description:
Dec 11 13:37:26 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.104, lip=66.85.158.91, TLS handshaking: Connection closed, session=</dyooqhFKWdAPsVo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.128.162.144
country_id: 6252001
description:
2025-12-11 13:36:48 dovecot_plain authenticator failed for 71-128-162-144.lightspeed.nsvltn.sbcglobal.net ([89.116.164.85]) [71.128.162.144]:45347: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 11 13:37:18 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cCU8oqhF/udBMQHe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 11 13:37:18 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<yAY4oqhFKqJKUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-11 13:37:34 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:51243: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 11 13:37:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, TLS: Connection closed, session=<T14to6hF0qNKUi8E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 11 13:37:38 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.222, lip=66.85.158.92, TLS handshaking: Connection closed, session=<zKhto6hF8DlBMQHe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec 11 13:37:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TAe/o6hFUGBAPsVc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 13:39:12 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53501: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-11 13:38:56 dovecot_plain authenticator failed for (depter) [199.192.123.12]:56458: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.231
country_id: 3469034
description:
Dec 11 13:39:32 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.251.231, lip=66.85.158.91, TLS, session=<5SHtqKhF5tC60fvn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.46
country_id: 1269750
description:
Dec 11 13:39:53 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=103.25.132.46, lip=66.85.158.91, TLS, session=<WYdQqqhF8bdnGYQu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-11 13:40:04 dovecot_plain authenticator failed for (yanchne) [5.32.22.218]:52249: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.230.96
country_id: 3865483
description:
2025-12-11 13:40:52 dovecot_login authenticator failed for ([190.182.230.96]) [190.182.230.96]:43631: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.211.153
country_id: 3469034
description:
2025-12-11 13:40:54 dovecot_plain authenticator failed for ([89.116.164.85]) [177.128.211.153]:46537: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.254.64.208
country_id: 1643084
description:
2025-12-11 13:41:08 dovecot_plain authenticator failed for ([89.116.164.85]) [180.254.64.208]:48515: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.211
country_id: 1861060
description:
2025-12-11 13:41:14 dovecot_login authenticator failed for p83212-obmd01.osaka.ocn.ne.jp [180.7.154.211]:36890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.95.45
country_id: 1282988
description:
2025-12-11 13:41:23 dovecot_plain authenticator failed for ([89.116.164.85]) [182.93.95.45]:37776: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-11 13:43:03 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (imbil) [96.230.65.90]:54986: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 13:44:49 host2 sshd[3459481]: Disconnected from invalid user admin 2.57.121.112 port 41882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.32.66.103
country_id: 3703430
description:
2025-12-11 13:45:10 dovecot_plain authenticator failed for ([89.116.164.85]) [190.32.66.103]:43172: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.24.61.208
country_id: 99237
description:
2025-12-11 13:45:23 dovecot_plain authenticator failed for ([89.116.164.85]) [185.24.61.208]:62903: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.69.34.36
country_id: 6251999
description:
2025-12-11 13:45:34 dovecot_plain authenticator failed for bras-base-toroon4223w-grc-02-76-69-34-36.dsl.bell.ca ([89.116.164.85]) [76.69.34.36]:44938: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-11 13:45:50 dovecot_login authenticator failed for (173-31-197-108.client.mchsi.com) [173.31.197.108]:54770: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-11 13:46:03 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:35112: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.9
country_id: 1733045
description:
2025-12-11 13:46:26 dovecot_login authenticator failed for ([49.124.153.9]) [49.124.153.9]:51556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-11 13:46:38 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:57129: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-11 13:46:53 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:56300: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-11 13:47:04 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:45602: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-11 13:48:58 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (gropic) [74.90.213.28]:37958: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.86.113.148
country_id: 3625428
description:
2025-12-11 13:49:27 dovecot_plain authenticator failed for ([89.116.164.85]) [82.86.113.148]:46812: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.86.113.148
country_id: 3625428
description:
2025-12-11 13:49:34 dovecot_login authenticator failed for ([89.116.164.85]) [82.86.113.148]:46812: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.216.1.175
country_id: 953987
description:
2025-12-11 13:49:42 dovecot_plain authenticator failed for ([89.116.164.85]) [102.216.1.175]:40666: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.207.178
country_id: 6252001
description:
2025-12-11 13:49:54 dovecot_plain authenticator failed for c-73-231-207-178.hsd1.ca.comcast.net ([89.116.164.85]) [73.231.207.178]:54384: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-11 13:51:25 dovecot_plain authenticator failed for (ducenes) [12.150.243.22]:20797: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-11 13:52:17 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:55110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-11 13:52:31 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:51490: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.161.157
country_id: 3865483
description:
2025-12-11 13:51:47 dovecot_login authenticator failed for ([190.185.161.157]) [190.185.161.157]:57120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:52:04 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1hgA16hFrtADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-11 13:52:34 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:57053: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.195
country_id: 3469034
description:
Dec 11 13:52:58 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.248.195, lip=66.85.158.91, TLS, session=<Hqon2ahFiqS60fjD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-11 13:53:04 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:42052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.18
country_id: 3469034
description:
Dec 11 13:53:17 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.44.71.18, lip=66.85.158.91, TLS, session=<Vg9V2qhFqp2xLEcS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:52:31 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<g+mm2KhFAOQDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 13:52:56 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:33425: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-11 13:52:44 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:57100: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-11 13:53:33 dovecot_login authenticator failed for ([165.154.202.101]) [165.154.202.101]:28276: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.171.62
country_id: 3923057
description:
2025-12-11 13:53:40 dovecot_plain authenticator failed for ([89.116.164.85]) [181.115.171.62]:49517: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.79.229.35
country_id: 3469034
description:
2025-12-11 13:53:55 dovecot_plain authenticator failed for ([89.116.164.85]) [189.79.229.35]:57488: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:54:27 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yhaP36hFXpcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:55:07 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<kHjx4ahFesIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:56:29 host2 dovecot[3293415]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<uoTJ5qhFYJ0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:56:50 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<lukV6KhFhOkDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-11 13:58:09 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:35426: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2025-12-11 13:58:28 dovecot_login authenticator failed for ([182.79.126.100]) [182.95.57.194]:54898: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:57:31 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2WmE6qhFfqsDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-11 13:57:43 dovecot_plain authenticator failed for c-73-21-28-14.hsd1.ga.comcast.net (granse) [73.21.28.14]:52356: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:58:59 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KES676hF8tgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 13:59:31 host2 dovecot[3293415]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<8S+v8ahFwOUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 14:00:49 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<4EpI9qhFDKEDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-11 14:02:28 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:41836: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-11 14:01:36 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:42782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 14:01:52 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BwEW+qhF2KgDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-11 14:01:57 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:54860: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-11 14:03:10 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:37586: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 11 14:03:28 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<jpjI/6hF3IgDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-11 14:05:33 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:53278: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-11 14:05:52 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:42358: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-11 14:10:16 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:59070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-12-11 14:10:28 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:53531: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-11 14:10:28 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:37066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-11 14:11:31 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:33582: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-11 14:10:42 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:49968: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2025-12-11 14:11:47 dovecot_login authenticator failed for ([41.59.99.40]) [41.59.99.40]:54623: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-12-11 14:17:10 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:37488: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.237.54
country_id: 1643084
description:
2025-12-11 14:16:58 dovecot_login authenticator failed for ([103.79.237.54]) [103.79.237.54]:43076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2025-12-11 14:20:05 dovecot_login authenticator failed for (nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:34180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-11 14:20:24 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:55364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.63.161.126
country_id: 2510769
description:
2025-12-11 14:20:32 dovecot_login authenticator failed for static-126-161-63-95.ipcom.comunitel.net [95.63.161.126]:38791: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-12-11 14:20:40 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:43824: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-11 14:20:58 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:59114: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-11 14:22:16 dovecot_plain authenticator failed for (exablen) [46.10.210.68]:48210: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-11 14:26:00 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:47636: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.109
country_id: 6252001
description:
2025-12-11 14:26:12 dovecot_login authenticator failed for ([98.185.120.109]) [98.185.120.109]:47872: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.172
country_id: 6252001
description:
Dec 11 14:27:29 host2 pure-ftpd[3503799]: (?@205.210.31.172) [INFO] New connection from 205.210.31.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-11 14:27:04 dovecot_plain authenticator failed for (mingned) [102.53.15.56]:42910: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-11 14:27:16 dovecot_plain authenticator failed for (rattuae) [65.20.147.45]:57423: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2025-12-11 14:29:53 dovecot_login authenticator failed for (nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:47554: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-11 14:29:37 dovecot_login authenticator failed for (249.92.zcomnetworks.com.pk) [103.148.92.249]:37274: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.203.231.220
country_id: 2464461
description:
Dec 11 14:31:25 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=196.203.231.220, lip=66.85.158.91, session=<WAagY6lFdoPEy+fc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.230.130
country_id: 1269750
description:
Dec 11 14:31:40 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<marketing>, method=PLAIN, rip=122.187.230.130, lip=66.85.158.91, session=<aYVoZKlFmdN6u+aC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.206.93.90
country_id: 290557
description:
Dec 11 14:31:52 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<marketing>, method=PLAIN, rip=94.206.93.90, lip=66.85.158.91, session=<eSM5ZalFfKJezl1a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.100.107.238
country_id: 1831722
description:
Dec 11 14:32:13 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<marketing>, method=PLAIN, rip=175.100.107.238, lip=66.85.158.91, TLS, session=<lEV8ZalF0pOvZGvu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 14:33:29 host2 sshd[3509021]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-11 14:34:28 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:33758: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.46
country_id: 6252001
description:
2025-12-11 14:34:40 dovecot_login authenticator failed for ([98.181.46.46]) [98.181.46.46]:38172: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-11 14:35:06 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:47202: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.155
country_id: 1733045
description:
2025-12-11 14:35:08 dovecot_login authenticator failed for ([49.124.154.155]) [49.124.154.155]:43758: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-11 14:36:22 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:45108: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-11 14:37:49 dovecot_plain authenticator failed for (prote) [24.93.140.162]:58926: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-11 14:41:08 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:42430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-11 14:41:26 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:41440: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-11 14:41:28 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:58695: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 14:41:49 host2 sshd[3516771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.204
country_id: 6252001
description:
2025-12-11 14:41:52 dovecot_login authenticator failed for ([72.214.132.204]) [72.214.132.204]:39583: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-11 14:42:55 dovecot_plain authenticator failed for (lurbid) [154.144.255.208]:43598: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.38.183
country_id: 3469034
description:
Dec 11 14:42:57 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=189.127.38.183, lip=66.85.158.91, TLS, session=<gJLti6lFs8G9fya3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.246
country_id: 3469034
description:
Dec 11 14:43:16 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=186.209.251.246, lip=66.85.158.91, TLS, session=<5oMWjalFYLa60fv2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 11 14:45:13 host2 sshd[3520585]: Disconnected from invalid user kashan 103.187.165.26 port 34344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-11 14:45:09 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (braps) [73.168.136.150]:35842: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 11 14:46:18 host2 sshd[3522015]: Disconnected from invalid user newusername 5.198.176.28 port 42120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 11 14:46:15 host2 sshd[3521981]: Disconnected from invalid user robin 197.5.145.73 port 56204 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.236.9
country_id: 6252001
description:
Dec 11 14:46:58 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.174.236.9, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Q0VVm6lF5OmsruwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.6
country_id: 6252001
description:
Dec 11 14:47:18 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.65.194.6, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VzySnKlF0LoUQcIG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 11 14:48:37 host2 sshd[3524723]: Disconnected from invalid user newusername 197.5.145.73 port 56209 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec 11 14:48:57 host2 sshd[3524995]: Disconnected from invalid user kali 74.243.236.86 port 50698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 11 14:50:14 host2 sshd[3526319]: Disconnected from invalid user examen 198.12.75.220 port 33430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 11 14:50:29 host2 sshd[3526557]: Disconnected from invalid user airflow 35.145.253.68 port 46401 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 11 14:49:55 host2 sshd[3525834]: Disconnected from invalid user adminuser 103.187.165.26 port 33392 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 11 14:50:00 host2 sshd[3525896]: Received disconnect from 197.5.145.73 port 56212:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-11 14:51:06 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 14:51:07 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<HacWqqlF1pg+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 11 14:51:24 host2 sshd[3527307]: Disconnected from invalid user james 5.198.176.28 port 42224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.60.13
country_id: 3469034
description:
2025-12-11 14:51:28 dovecot_login authenticator failed for clientes-60.13.dbug.com.br [177.10.60.13]:42087: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 11 14:50:52 host2 sshd[3526862]: Disconnected from invalid user mario 197.5.145.73 port 56214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 11 14:51:04 host2 sshd[3527054]: Disconnected from invalid user newusername 35.145.253.68 port 49023 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 11 14:51:20 host2 sshd[3527275]: Disconnected from invalid user robin 103.187.165.26 port 57298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.216.2
country_id: 1643084
description:
Dec 11 14:50:50 host2 sshd[3526835]: Disconnected from invalid user kashan 103.55.216.2 port 44478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 11 14:51:59 host2 sshd[3527829]: Disconnected from invalid user ubuntu 125.20.16.22 port 26524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 11 14:52:11 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<96DpralFELQ+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 11 14:51:37 host2 sshd[3527524]: Disconnected from invalid user examen 35.145.253.68 port 46335 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 11 14:51:56 host2 sshd[3527780]: Disconnected from invalid user kali 5.198.176.28 port 42276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Dec 11 14:52:31 host2 sshd[3528321]: Disconnected from invalid user kashan 5.198.176.28 port 42330 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 11 14:52:29 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<kmD6rqlF+tM+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.216.2
country_id: 1643084
description:
Dec 11 14:51:34 host2 sshd[3527478]: Disconnected from invalid user adminuser 103.55.216.2 port 60272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec 11 14:51:54 host2 sshd[3527762]: Disconnected from invalid user ubuntu 74.243.236.86 port 51610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.216.2
country_id: 1643084
description:
Dec 11 14:53:11 host2 sshd[3528977]: Disconnected from invalid user ubuntu 103.55.216.2 port 35996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 11 14:53:18 host2 sshd[3529078]: Disconnected from invalid user mario 35.145.253.68 port 48720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 11 14:53:25 host2 sshd[3529128]: Disconnected from invalid user newusername 103.187.165.26 port 34624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec 11 14:54:24 host2 sshd[3530428]: Disconnected from invalid user maint 74.243.236.86 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 11 14:54:27 host2 sshd[3530489]: Disconnected from invalid user robin 35.145.253.68 port 48740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 14:54:38 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (reepernia) [217.215.74.195]:53035: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 11 14:54:49 host2 sshd[3530795]: Disconnected from invalid user james 103.187.165.26 port 40696 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.233
country_id: 6252001
description:
Dec 11 14:55:24 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=</F2LualFWKos3Lzp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-11 14:55:28 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:39291: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec 11 14:54:50 host2 sshd[3530834]: Disconnected from invalid user adminuser 5.198.176.28 port 42552 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 11 14:54:38 host2 sshd[3530631]: Disconnected from invalid user mario 125.20.16.22 port 52370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-11 14:55:47 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (cosisty) [68.46.148.180]:34698: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Dec 11 14:55:38 host2 sshd[3531654]: Disconnected from invalid user james 74.243.236.86 port 48422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-12-11 14:55:43 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:39924: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 11 14:57:15 host2 sshd[3533251]: Disconnected from invalid user mario 198.12.75.220 port 60040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.75.220
country_id: 6252001
description:
Dec 11 14:58:39 host2 sshd[3535072]: Disconnected from invalid user james 198.12.75.220 port 34420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-11 14:58:56 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:36482: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-12-11 14:59:05 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:60233: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.237.20.101
country_id: 3175395
description:
Dec 11 14:59:20 host2 sshd[3535637]: Disconnecting authenticating user root 95.237.20.101 port 39644: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-12-11 14:59:21 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:57894: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.237.20.101
country_id: 3175395
description:
Dec 11 14:59:20 host2 sshd[3535637]: error: maximum authentication attempts exceeded for root from 95.237.20.101 port 39644 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-11 14:58:42 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:56708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.160
country_id: 6252001
description:
2025-12-11 14:58:42 dovecot_login authenticator failed for wsip-184-191-250-160.fv.ks.cox.net [184.191.250.160]:37579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.237.20.101
country_id: 3175395
description:
Dec 11 14:59:32 host2 sshd[3535842]: error: maximum authentication attempts exceeded for root from 95.237.20.101 port 36932 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-11 14:59:35 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:41410: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 14:59:42 host2 sshd[3536113]: Disconnected from invalid user admin 62.60.131.157 port 35881 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-11 15:00:22 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:34431: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.140.198
country_id: 1819730
description:
2025-12-11 15:00:22 dovecot_login authenticator failed for ([180.188.140.198]) [180.188.140.198]:36121: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.237.20.101
country_id: 3175395
description:
Dec 11 14:59:32 host2 sshd[3535842]: Disconnecting authenticating user root 95.237.20.101 port 36932: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-12-11 15:01:26 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:43954: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 15:01:25 dovecot_plain authenticator failed for (tionbal) [102.53.15.18]:32950: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 15:00:34 host2 sshd[3537205]: Disconnected from invalid user admin 2.57.121.112 port 56852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-11 15:00:43 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:30133: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.148
country_id: 1269750
description:
2025-12-11 15:01:47 dovecot_login authenticator failed for (nsg-corporate-148.227.187.122.airtel.in) [122.187.227.148]:38770: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-11 15:06:27 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:53630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.39.230
country_id: 3202326
description:
2025-12-11 15:07:27 dovecot_login authenticator failed for ([5.59.39.230]) [5.59.39.230]:60564: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-11 15:06:43 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:49362: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-11 15:06:55 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:39934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 11 15:08:28 host2 sshd[3545411]: Disconnected from invalid user nami 78.109.200.147 port 57670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 11 15:07:39 host2 sshd[3544509]: Disconnected from invalid user informix 51.77.158.102 port 52496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 11 15:09:04 host2 sshd[3546143]: Disconnected from invalid user dudu 43.227.185.238 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-11 15:09:29 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (hetal) [68.46.148.180]:45790: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.158.102
country_id: 3017382
description:
Dec 11 15:08:39 host2 sshd[3545616]: Disconnected from invalid user ftp_user 51.77.158.102 port 55020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 11 15:08:57 host2 sshd[3545944]: Disconnected from invalid user ionguest 78.109.200.147 port 39658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-11 15:09:33 dovecot_plain authenticator failed for (huboloble) [102.53.15.180]:51606: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-11 15:09:35 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (frumoripe) [174.169.224.27]:49756: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 15:09:39 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (trotoph) [87.103.126.54]:48275: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.109.200.147
country_id: 130758
description:
Dec 11 15:10:25 host2 sshd[3548037]: Disconnected from invalid user prince 78.109.200.147 port 42030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 11 15:10:54 host2 sshd[3548679]: Disconnected from invalid user ansible 78.109.200.147 port 52200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 11 15:11:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1bDe8qlFouA+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.116
country_id: 3996063
description:
Dec 11 15:11:39 host2 sshd[3549450]: Disconnected from invalid user arjun 148.216.49.116 port 48416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 11 15:12:32 host2 sshd[3550387]: Disconnected from invalid user diego 154.113.10.34 port 34638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 11 15:12:44 host2 sshd[3550587]: Disconnected from invalid user asad 43.227.185.238 port 38238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.216.49.116
country_id: 3996063
description:
Dec 11 15:12:46 host2 sshd[3550649]: Disconnected from invalid user devops 148.216.49.116 port 33296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 11 15:13:27 host2 sshd[3551360]: Disconnected from invalid user username 45.78.201.208 port 40462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Dec 11 15:14:03 host2 sshd[3551992]: Disconnected from invalid user wesley 43.227.185.238 port 57914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 11 15:13:47 host2 sshd[3551735]: Disconnected from invalid user ubuntu 154.113.10.34 port 47204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.199
country_id: 933860
description:
Dec 11 15:15:26 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.215.199, lip=66.85.158.91, TLS, session=<j4X0/6lFKJEp2NfH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 15:15:31 host2 sshd[3554369]: Disconnected from invalid user admin 2.57.121.112 port 60128 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.56
country_id: 3865483
description:
Dec 11 15:15:03 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.250.56, lip=66.85.158.91, TLS, session=<qjqo/qlFwrSzAPo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.116
country_id: 3996063
description:
Dec 11 15:15:11 host2 sshd[3553801]: Disconnected from invalid user erp 148.216.49.116 port 37444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.25
country_id: 6252001
description:
Dec 11 15:16:17 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.25, lip=66.85.158.92, TLS, session=<R0MxBKpF5P2TuYQZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.113.10.34
country_id: 2328926
description:
Dec 11 15:16:19 host2 sshd[3555359]: Disconnected from invalid user oracle 154.113.10.34 port 37316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.26.213
country_id: 1861060
description:
2025-12-11 15:16:10 dovecot_login authenticator failed for knet202126026213.kvision.ne.jp [202.126.26.213]:49476: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-11 15:16:51 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:45076: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.15.226.44
country_id: 617790
description:
Dec 11 15:18:18 host2 sshd[3557499]: Disconnecting invalid user admin 45.15.226.44 port 55086: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.226.44
country_id: 617790
description:
Dec 11 15:17:56 host2 sshd[3557158]: Disconnecting authenticating user root 45.15.226.44 port 41448: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.226.44
country_id: 617790
description:
Dec 11 15:17:56 host2 sshd[3557158]: error: maximum authentication attempts exceeded for root from 45.15.226.44 port 41448 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-11 15:20:32 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:39598: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 11 15:19:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<li3NEKpFuuw+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.48.89
country_id: 6251999
description:
2025-12-11 15:20:05 dovecot_login authenticator failed for (89.48.158.104.in-addr.arpa) [104.158.48.89]:36082: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.192
country_id: 1269750
description:
2025-12-11 15:20:11 dovecot_login authenticator failed for (nsg-corporate-192.230.187.122.airtel.in) [122.187.230.192]:58472: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-11 15:20:14 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:1779: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 15:20:25 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<1cnfEqpFEI0+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 15:20:54 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<bAeUFKpFKrY+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.55.15
country_id: 1168579
description:
Dec 11 15:23:29 host2 sshd[3562825]: Disconnected from invalid user admin 182.180.55.15 port 45866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-11 15:22:40 dovecot_plain authenticator failed for (bediver) [62.73.121.209]:46922: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-11 15:22:44 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (harcer) [24.1.200.187]:38140: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 11 15:24:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=</snhH6pFKoKG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 11 15:24:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<LKa9IapFcNYv8Dk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-11 15:24:47 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:52241: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-12-11 15:25:11 dovecot_login authenticator failed for ([49.124.155.162]) [49.124.155.162]:40534: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-11 15:25:12 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:43452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 15:25:25 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=</lrCJKpF/JA+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-11 15:25:28 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:33601: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 11 15:25:38 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2ACBJapFTqovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-11 15:26:21 dovecot_login authenticator failed for ([121.73.162.242]) [121.73.162.242]:57732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-11 15:26:35 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:56744: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 15:28:21 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<S603L6pFtLAro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 11 15:29:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<YPEkM6pF7LFnmSo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.55.15
country_id: 1168579
description:
Dec 11 15:28:36 host2 sshd[3567365]: Disconnected from invalid user xmr 182.180.55.15 port 38090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 11 15:29:24 host2 sshd[3567967]: Disconnected from invalid user oracle 103.23.199.128 port 35272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Dec 11 15:30:07 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.92, TLS: Connection closed, session=<yzqsNapF9MvHLZqT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.55.15
country_id: 1168579
description:
Dec 11 15:30:10 host2 sshd[3568958]: Disconnected from invalid user user6 182.180.55.15 port 47268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2025-12-11 15:30:39 dovecot_login authenticator failed for (189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:59340: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 11 15:31:00 host2 sshd[3569821]: Disconnected from invalid user facai 103.23.199.128 port 51130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-11 15:31:03 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:56870: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.58
country_id: 6252001
description:
Dec 11 15:31:21 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.58, lip=66.85.158.92, session=<cd4UOqpF4OfN0h86>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-11 15:31:28 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:33192: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.55.15
country_id: 1168579
description:
Dec 11 15:31:39 host2 sshd[3570534]: Disconnected from invalid user odoo 182.180.55.15 port 55284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-11 15:32:04 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:37729: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 11 15:32:32 host2 sshd[3571347]: Disconnected from invalid user ftpuser 103.23.199.128 port 42666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 11 15:31:32 host2 sshd[3570305]: Disconnected from invalid user diego 45.78.201.208 port 44678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 11 15:32:38 host2 sshd[3571441]: Disconnected from invalid user sftpuser 45.78.201.208 port 40210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 11 15:33:18 host2 sshd[3572240]: Disconnected from invalid user vpn 103.23.199.128 port 47956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 15:35:05 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<vpBSR6pFaM8+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 15:36:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<xCKtTKpFiJQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 11 15:38:47 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<g3aPVKpFWLqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 11 15:39:56 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<zP6jWKpFjLA+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-11 15:40:45 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:43892: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 11 15:40:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<bozLW6pFvqA+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-11 15:41:01 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:53394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 15:42:29 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<jV7KYapFBLE+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.116.242
country_id: 1643084
description:
Dec 11 15:43:14 host2 sshd[3581284]: Disconnected from invalid user sftpuser 103.213.116.242 port 51944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 15:43:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<a2FqZapFjrov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 15:44:08 host2 sshd[3581909]: Disconnected from invalid user  62.60.131.157 port 49774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-12-11 15:45:21 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:48747: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-11 15:45:09 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:50833: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.107
country_id: 2661886
description:
Dec 11 15:45:45 host2 sshd[3583441]: Disconnected from invalid user elasticsearch 155.4.244.107 port 4139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.116.242
country_id: 1643084
description:
Dec 11 15:45:52 host2 sshd[3583533]: Disconnected from invalid user steam 103.213.116.242 port 33546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 11 15:45:53 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<kvb1bapFWJ8+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Dec 11 15:46:06 host2 sshd[3583919]: Disconnected from invalid user runner 118.193.38.97 port 60580 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.97
country_id: 1819730
description:
Dec 11 15:47:23 host2 sshd[3584956]: Disconnected from invalid user vyos 118.193.38.97 port 31276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.116.242
country_id: 1643084
description:
Dec 11 15:46:32 host2 sshd[3584276]: Disconnected from invalid user sabina 103.213.116.242 port 46158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Dec 11 15:47:11 host2 sshd[3584776]: Disconnected from invalid user cyril 155.4.244.107 port 53413 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.116.242
country_id: 1643084
description:
Dec 11 15:47:50 host2 sshd[3585174]: Disconnected from invalid user music 103.213.116.242 port 43162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-12-11 15:48:54 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:59326: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.151.63.80
country_id: 1643084
description:
Dec 11 15:49:00 host2 sshd[3586397]: Disconnected from invalid user elasticsearch 103.151.63.80 port 54654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-11 15:49:14 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:35730: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-11 15:49:26 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:50258: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 11 15:49:27 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<dGCzeqpFsp6kXGTY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Dec 11 15:48:37 host2 sshd[3585737]: Disconnected from invalid user debianuser 118.193.38.97 port 56970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.242.30.71
country_id: 290557
description:
Dec 11 15:49:57 host2 sshd[3587050]: Disconnected from invalid user miladmim 151.242.30.71 port 50958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 11 15:50:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<v9lPfqpFZIQ+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-11 15:49:45 dovecot_login authenticator failed for ([182.95.178.206]) [182.95.178.206]:50472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 15:49:45 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<SpDCe6pF1rs+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 11 15:49:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<HZgbfKpF3MPD+hnW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.151.63.80
country_id: 1643084
description:
Dec 11 15:49:41 host2 sshd[3586850]: Disconnected from invalid user sabina 103.151.63.80 port 59416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Dec 11 15:50:07 host2 sshd[3587352]: Disconnected from invalid user sysadmin 155.4.244.107 port 11818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-11 15:50:24 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:34889: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.242.30.71
country_id: 290557
description:
Dec 11 15:50:33 host2 sshd[3587759]: Disconnected from invalid user hb 151.242.30.71 port 51730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-11 15:51:02 dovecot_login authenticator failed for ([182.95.228.90]) [182.95.228.90]:54708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.242.30.71
country_id: 290557
description:
Dec 11 15:51:07 host2 sshd[3588278]: Disconnected from invalid user aaa 151.242.30.71 port 49836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.151.63.80
country_id: 1643084
description:
Dec 11 15:52:20 host2 sshd[3589183]: Disconnected from invalid user carlos 103.151.63.80 port 37740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 15:53:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<l7xriKpF3uM+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 11 15:54:01 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<Ajb+iqpFXqI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-11 15:54:17 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (xemothably) [98.193.112.85]:57130: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 11 15:54:46 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<adWzjapFnoku4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-11 15:55:02 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:39081: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-11 15:55:13 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:58911: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 11 15:54:33 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<qiDqjKpF8LC8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-11 15:56:14 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:60812: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-11 15:55:43 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:34318: 535 Incorrect authentication data (set_id=marketing@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 11 15:58:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<gBdTmqpF3t8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 15:59:20 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<b4gNnqpFWq8+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 11 15:59:32 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<SC6/nqpFSryl6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.136.65.186
country_id: 3469034
description:
2025-12-11 16:00:17 dovecot_plain authenticator failed for ([89.116.164.85]) [177.136.65.186]:60934: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.44.169
country_id: 587116
description:
2025-12-11 16:00:31 dovecot_plain authenticator failed for ([89.116.164.85]) [158.181.44.169]:1732: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.38.193.198
country_id: 3469034
description:
2025-12-11 16:00:04 dovecot_plain authenticator failed for ([89.116.164.85]) [177.38.193.198]:25006: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 11 16:00:35 host2 sshd[3596644]: Disconnected from invalid user deployer 188.166.156.169 port 60286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.44.169
country_id: 587116
description:
2025-12-11 16:00:38 dovecot_login authenticator failed for ([89.116.164.85]) [158.181.44.169]:1732: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 11 16:02:06 host2 sshd[3598015]: Disconnected from invalid user deployer 188.166.156.169 port 43946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 16:01:35 host2 sshd[3597616]: Disconnected from invalid user user 2.57.121.25 port 48681 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 11 16:02:45 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<iIs5qqpF7tLO7iqJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.234.225.9
country_id: 2510769
description:
[2025-12-11 16:02:54 +0530] info [cpaneld] 200.234.225.9 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.164.117.179
country_id: 6252001
description:
2025-12-11 16:03:24 dovecot_plain authenticator failed for 184-164-117-179.dynamic.mammothnetworks.com ([89.116.164.85]) [184.164.117.179]:20466: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 16:03:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<LdTxrKpF4LpnJFMP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 11 16:02:36 host2 sshd[3598364]: Disconnected from invalid user git 188.166.156.169 port 39420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.139.82
country_id: 3658394
description:
2025-12-11 16:03:37 dovecot_plain authenticator failed for ([89.116.164.85]) [200.24.139.82]:34214: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.49.193.52
country_id: 102358
description:
2025-12-11 16:03:49 dovecot_plain authenticator failed for ([89.116.164.85]) [94.49.193.52]:57658: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-11 16:04:12 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:49449: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-11 16:04:04 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:53494: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-11 16:04:11 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:41943: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-11 16:04:19 dovecot_login authenticator failed for ([27.123.119.219]) [182.95.226.118]:41800: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-11 16:04:20 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:54952: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-11 16:04:23 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:40703: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-11 16:05:10 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:54031: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 11 16:05:16 host2 sshd[3601169]: Received disconnect from 188.166.156.169 port 45326:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 11 16:05:16 host2 sshd[3601169]: Disconnected from invalid user anaconda 188.166.156.169 port 45326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 11 16:04:46 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<+UlssapFgKU+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-11 16:04:49 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:48132: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.97.198
country_id: 337996
description:
2025-12-11 16:05:03 dovecot_login authenticator failed for ([197.156.97.198]) [197.156.97.198]:50530: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-11 16:05:33 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:57704: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 16:06:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<rI74t6pFWOgro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 11 16:06:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<8XZ7uKpF5OQ+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 16:06:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<l8vluKpF/J8v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 16:07:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<4U6JuqpF4oE+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.136.231.166
country_id: 1814991
description:
Dec 11 16:07:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=8.136.231.166, lip=66.85.158.91, session=<HlMbu6pFlMIIiOem>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 11 16:07:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1NNlvKpFpJgvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.141.41.34
country_id: 2782113
description:
2025-12-11 16:08:00 dovecot_plain authenticator failed for 91.141.41.34.wireless.dyn.drei.com ([89.116.164.85]) [91.141.41.34]:14248: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 16:07:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<Bfv9vKpF1KlnsX0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.37.220.125
country_id: 3865483
description:
2025-12-11 16:08:14 dovecot_plain authenticator failed for ([89.116.164.85]) [179.37.220.125]:36298: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.136.96.154
country_id: 3996063
description:
2025-12-11 16:08:26 dovecot_plain authenticator failed for ([89.116.164.85]) [189.136.96.154]:35624: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-11 16:08:29 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:51915: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 11 16:07:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<oKpZvKpFZrErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 11 16:10:54 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<bVpix6pFLIIu4ntB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 16:12:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<wiqsy6pFVOo+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 11 16:12:01 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<9Ntfy6pFMMwI3tq7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.183.235.202
country_id: 3996063
description:
2025-12-11 16:16:43 dovecot_login authenticator failed for ([89.116.164.85]) [189.183.235.202]:34410: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.163.115.31
country_id: 690791
description:
2025-12-11 16:16:49 dovecot_plain authenticator failed for ([89.116.164.85]) [188.163.115.31]:65308: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.147.16.143
country_id: 3996063
description:
2025-12-11 16:17:01 dovecot_plain authenticator failed for ([89.116.164.85]) [187.147.16.143]:54210: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 11 16:17:16 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<00gk3qpFlIAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-11 16:18:01 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (nally) [73.88.196.91]:40970: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-11 16:19:12 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:37026: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 16:20:01 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<AJvy56pF7OIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 16:19:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<BLX35apFMuU+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-12-11 16:19:31 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:57610: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-11 16:19:39 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:55070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 11 16:19:54 host2 pure-ftpd[3614976]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-11 16:19:57 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:39513: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 16:20:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<a5H+6apFWJFnsX0d>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 11 16:22:20 host2 sshd[3617391]: Disconnected from invalid user gg 165.154.200.14 port 45434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 11 16:22:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<uC6t8KpFvofIaZyl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 11 16:26:12 host2 sshd[3620456]: Disconnected from invalid user nikita 165.154.200.14 port 50366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.148.15
country_id: 1861060
description:
Dec 11 16:26:27 host2 sshd[3620699]: Disconnected from invalid user root1 163.5.148.15 port 50386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-11 16:26:34 dovecot_login authenticator failed for (187.161.173.2-clientes-izzi.mx) [187.161.173.2]:60872: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 11 16:26:42 host2 sshd[3620865]: Disconnected from invalid user pc 192.76.153.90 port 56140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-11 16:26:18 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:38921: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 16:27:47 host2 sshd[3621655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.188.65.233
country_id: 2921044
description:
2025-12-11 16:28:01 dovecot_plain authenticator failed for (treptor) [64.188.65.233]:58294: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 11 16:28:06 host2 sshd[3621851]: Disconnected from invalid user gg 192.76.153.90 port 56220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.148.15
country_id: 1861060
description:
Dec 11 16:27:51 host2 sshd[3621679]: Disconnected from invalid user jonas 163.5.148.15 port 44302 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 11 16:28:58 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<oCIHCKtF4t5noNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 16:28:24 host2 sshd[3622004]: Disconnected from invalid user  62.60.131.157 port 12002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.5.148.15
country_id: 1861060
description:
Dec 11 16:28:27 host2 sshd[3622048]: Disconnected from invalid user postgres 163.5.148.15 port 60256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 11 16:28:45 host2 sshd[3622192]: Disconnected from invalid user root1 165.154.200.14 port 39950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-11 16:29:24 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:53120: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 11 16:29:35 host2 sshd[3622767]: Disconnected from invalid user ubuntu 165.154.200.14 port 53432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.148.15
country_id: 1861060
description:
Dec 11 16:29:40 host2 sshd[3622841]: Disconnected from invalid user test 163.5.148.15 port 59552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 11 16:30:31 host2 sshd[3623769]: Disconnected from invalid user admin 2.57.121.112 port 33657 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 16:30:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<toeXDqtFrq8+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 11 16:31:29 host2 sshd[3624546]: Disconnected from invalid user test 192.76.153.90 port 56394 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.178.110.48
country_id: 732800
description:
[2025-12-11 16:32:05 +0530] info [cpaneld] 195.178.110.48 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.206.246
country_id: 99237
description:
2025-12-11 16:32:09 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.206.246]:22780: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.200.14
country_id: 1880251
description:
Dec 11 16:31:15 host2 sshd[3624294]: Disconnected from invalid user postgres 165.154.200.14 port 37624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-12-11 16:31:19 dovecot_plain authenticator failed for (spomogran) [5.32.61.6]:52808: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-11 16:32:50 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:59234: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.206.246
country_id: 99237
description:
2025-12-11 16:32:16 dovecot_login authenticator failed for ([89.116.164.85]) [185.187.206.246]:22780: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.228.127.171
country_id: 3996063
description:
2025-12-11 16:32:21 dovecot_plain authenticator failed for ([89.116.164.85]) [177.228.127.171]:58527: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.90.252.75
country_id: 102358
description:
2025-12-11 16:32:33 dovecot_plain authenticator failed for ([89.116.164.85]) [2.90.252.75]:35585: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-11 16:32:36 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:43526: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 11 16:34:11 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<cfSsGqtF6rpnpBQq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 11 16:33:25 host2 sshd[3626253]: Disconnected from invalid user fleek 192.76.153.90 port 56520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 11 16:34:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<iPHlHKtFGIqWXx+e>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 16:36:09 host2 sshd[3628400]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 11 16:35:33 host2 sshd[3627993]: Disconnected from invalid user hdoop 162.240.39.179 port 32996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-12-11 16:37:06 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:43986: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-11 16:37:11 dovecot_login authenticator failed for (abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:54074: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 11 16:36:46 host2 sshd[3628789]: Disconnected from invalid user temp 162.240.39.179 port 57676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-12-11 16:38:06 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:55540: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-11 16:37:18 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:51370: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-11 16:37:44 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:57499: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 11 16:37:49 host2 sshd[3629583]: Disconnected from invalid user celery 162.240.39.179 port 54124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 11 16:38:20 host2 sshd[3629890]: Disconnected from invalid user peter 162.240.39.179 port 38242 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-11 16:38:33 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:35737: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 11 16:38:53 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<oN5yK6tFcO0+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 11 16:39:23 host2 sshd[3630509]: Disconnected from invalid user soksuser 162.240.39.179 port 34692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-11 16:39:37 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (joyerrett) [73.129.57.71]:45414: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.102.159.188
country_id: 3175395
description:
Dec 11 16:40:10 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=62.102.159.188, lip=66.85.158.91, TLS, session=<29k1L6tFxrA+Zp+8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.153
country_id: 1269750
description:
Dec 11 16:40:31 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.18.166.153, lip=66.85.158.91, TLS, session=<8zFVMKtFUd1nEqaZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 11 16:41:24 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<odtxNKtF4JIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-12-11 16:42:50 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:34530: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-11 16:43:44 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:53892: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-11 16:43:22 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:43672: 535 Incorrect authentication data (set_id=root@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 16:43:24 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<a/ecO6tFsrMvT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.69.224
country_id: 294640
description:
2025-12-11 16:43:27 dovecot_login authenticator failed for (2-55-69-224.orange.net.il) [2.55.69.224]:46787: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-11 16:44:28 dovecot_plain authenticator failed for (unhel) [5.32.22.218]:41705: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 16:44:33 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (revinnes) [217.215.74.195]:38022: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 11 16:46:09 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<Mh5xRatFMKA+PIdb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.135
country_id: 6252001
description:
Dec 11 16:45:38 host2 pure-ftpd[3634970]: (?@66.132.153.135) [INFO] New connection from 66.132.153.135


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 11 16:45:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<6ZvkRKtFqyBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 11 16:47:12 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<IA0/SatFlt0v8Dk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.235.7.1
country_id: 3077311
description:
2025-12-11 16:48:52 dovecot_plain authenticator failed for customer7-1.airweb.cz (ingly) [109.235.7.1]:53626: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-11 16:48:56 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (citic) [68.40.189.43]:39712: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-11 16:48:36 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (dedned) [98.193.112.85]:47954: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-11 16:49:41 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (track) [81.225.30.107]:52287: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-11 16:49:47 dovecot_plain authenticator failed for (feirowly) [65.20.148.165]:36561: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 16:50:55 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<6W95VqtFBtQro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-11 16:50:59 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (ellyprize) [98.193.112.85]:38262: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.168
country_id: 2635167
description:
Dec 11 16:52:03 host2 dovecot[3293415]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.168, lip=66.85.158.92, TLS, session=<fXuvWqtFwYtX7LCo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-11 16:53:10 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:34926: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 11 16:52:26 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<iFbqW6tFOL4+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-11 16:52:47 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:39921: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 16:53:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (siones) [87.103.126.54]:42006: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 16:54:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<ItXIYatF3IdnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 11 16:54:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<WurgYatFyoyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 16:54:22 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pS7YYqtF3NAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 11 16:54:58 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<BukEZatFGt0+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.58
country_id: 3469034
description:
Dec 11 16:55:55 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=138.186.197.58, lip=66.85.158.91, TLS, session=<8Bt3Z6tFiOyKusU6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 11 16:56:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<FlXmaKtFcMY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 11 16:56:03 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<n23ZaKtF4rk+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.194.222
country_id: 1269750
description:
Dec 11 16:56:16 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=103.213.194.222, lip=66.85.158.91, TLS, session=<R0OtaKtFzZFn1cLe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-11 16:56:20 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:52831: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 11 16:56:24 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<pIgkaqtF+MVnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.148.44.92
country_id: 2077456
description:
2025-12-11 16:56:35 dovecot_login authenticator failed for ip-206-148-44-92.internet.url.net.au [206.148.44.92]:54759: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 11 16:57:20 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pQVxbatFCJiPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.251.9
country_id: 1269750
description:
2025-12-11 17:01:21 dovecot_login authenticator failed for (static.ill.117.248.251.9.bsnl.co.in) [117.248.251.9]:36466: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 17:01:24 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<o1P/e6tFvIEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 11 17:01:43 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<InEdfatFWLw+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-11 17:01:49 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:33788: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.4
country_id: 1733045
description:
2025-12-11 17:01:52 dovecot_login authenticator failed for ([49.124.132.4]) [49.124.132.4]:60486: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-11 17:02:35 dovecot_login authenticator failed for (cm-178.232.36.204.get.no) [178.232.36.204]:36745: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-11 17:02:40 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:52376: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 17:02:46 host2 sshd[3648994]: Disconnected from invalid user user 2.57.121.25 port 47682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-11 17:02:57 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:54599: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-11 17:02:18 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:34274: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-11 17:02:23 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:54346: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 17:05:08 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<uCFViatFmsM+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-11 17:05:33 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (plating) [76.31.164.124]:49520: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-11 17:05:54 dovecot_plain authenticator failed for (unurost) [176.113.155.132]:46795: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 17:05:58 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (toperis) [87.103.126.54]:24444: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 11 17:06:10 host2 sshd[3651514]: Disconnected from invalid user www 199.195.248.191 port 39530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.23.236.56
country_id: 6252001
description:
Dec 11 17:05:22 host2 sshd[3650974]: Disconnected from invalid user zk 66.23.236.56 port 44094 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-11 17:07:08 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:44970: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-11 17:06:16 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (spated) [71.62.34.216]:57566: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-11 17:06:20 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (bubtanta) [73.168.136.150]:41724: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.196.213
country_id: 3469034
description:
Dec 11 17:06:20 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=138.186.196.213, lip=66.85.158.91, TLS, session=<IqCvjKtFreaKusTV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.121
country_id: 3865483
description:
Dec 11 17:06:42 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.5.21.121, lip=66.85.158.91, TLS, session=<JC7sjatFzd2+BRV5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-11 17:07:23 dovecot_login authenticator failed for ([110.77.148.87]) [110.77.148.87]:54662: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 11 17:07:29 host2 sshd[3652150]: Disconnected from invalid user ali 199.195.248.191 port 36706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-12-11 17:07:59 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:36588: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 11 17:08:05 host2 sshd[3652435]: Disconnected from invalid user mark 199.195.248.191 port 49412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 11 17:08:42 host2 sshd[3652788]: Disconnected from invalid user csserver 199.195.248.191 port 33886 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.208
country_id: 3469034
description:
Dec 11 17:09:02 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=177.53.165.208, lip=66.85.158.91, TLS, session=<UKsvlqtFntCxNaXQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 11 17:09:03 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<9h5Zl6tF6uKkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-11 17:08:25 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:49966: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.50
country_id: 953987
description:
Dec 11 17:08:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=102.64.39.50, lip=66.85.158.91, TLS, session=<uEW3lKtFzIBmQCcy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 11 17:09:18 host2 sshd[3653067]: Disconnected from invalid user newuser 199.195.248.191 port 46592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.23.236.56
country_id: 6252001
description:
Dec 11 17:10:03 host2 sshd[3653608]: Disconnected from invalid user www 66.23.236.56 port 34584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 11 17:10:27 host2 sshd[3653932]: Disconnected from invalid user test 27.111.32.174 port 54864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.109.4.35
country_id: 3686110
description:
Dec 11 17:10:29 host2 sshd[3653976]: Disconnected from invalid user user3 190.109.4.35 port 59204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.109.4.35
country_id: 3686110
description:
Dec 11 17:11:10 host2 sshd[3654454]: Disconnected from invalid user newuser 190.109.4.35 port 46362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 17:12:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<k+dFoqtF2NI+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 11 17:12:21 host2 sshd[3655266]: Disconnected from invalid user production 27.111.32.174 port 46176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 17:12:34 host2 sshd[3655416]: Disconnected from invalid user  62.60.131.157 port 58879 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.249.251
country_id: 1643084
description:
Dec 11 17:12:45 host2 sshd[3655501]: Disconnected from invalid user hamed 43.245.249.251 port 57328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.109.4.35
country_id: 3686110
description:
Dec 11 17:13:07 host2 sshd[3655880]: Disconnected from invalid user zk 190.109.4.35 port 56088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.23.236.56
country_id: 6252001
description:
Dec 11 17:12:20 host2 sshd[3655268]: Disconnected from invalid user test 66.23.236.56 port 47168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 11 17:13:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<HNfXp6tFarjD+hnW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.109.4.35
country_id: 3686110
description:
Dec 11 17:13:44 host2 sshd[3656374]: Disconnected from invalid user csserver 190.109.4.35 port 40420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.102.123.249
country_id: 1168579
description:
Dec 11 17:14:23 host2 sshd[3656814]: Disconnected from invalid user jonathan 66.102.123.249 port 60746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 11 17:15:02 host2 sshd[3657343]: Disconnected from invalid user newuser 27.111.32.174 port 37586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 11 17:15:41 host2 sshd[3658133]: Disconnected from invalid user mark 27.111.32.174 port 54912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 11 17:16:07 host2 sshd[3658547]: Disconnected from invalid user dj 167.71.128.40 port 56342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 11 17:15:18 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<bB6uratFeOgu4ntB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.102.123.249
country_id: 1168579
description:
Dec 11 17:16:37 host2 sshd[3658857]: Disconnected from invalid user nacos 66.102.123.249 port 47673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-11 17:17:24 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:56782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 17:17:39 host2 sshd[3659580]: Disconnected from invalid user user 2.57.121.25 port 35337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-11 17:17:39 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:38796: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 11 17:18:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<bvzOuatFzL0v+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.102.123.249
country_id: 1168579
description:
Dec 11 17:18:48 host2 sshd[3660432]: Disconnected from invalid user clara 66.102.123.249 port 34603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 11 17:20:01 host2 sshd[3661414]: Disconnected from invalid user jmarquez 167.71.128.40 port 58442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2025-12-11 17:20:15 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (antailinx) [84.5.129.68]:8625: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.176
country_id: 1643084
description:
Dec 11 17:20:34 host2 sshd[3661861]: Disconnected from invalid user runner 103.139.193.176 port 32818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.102.123.249
country_id: 1168579
description:
Dec 11 17:21:04 host2 sshd[3662190]: Disconnected from invalid user www-data 66.102.123.249 port 49767 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-11 17:21:08 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:35556: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 11 17:21:08 host2 sshd[3662234]: Disconnected from invalid user going 167.71.128.40 port 40768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.176
country_id: 1643084
description:
Dec 11 17:21:27 host2 sshd[3662447]: Disconnected from invalid user rock 103.139.193.176 port 46340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.81.99
country_id: 1269750
description:
2025-12-11 17:21:29 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [103.50.81.99]:33082: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 11 17:21:45 host2 sshd[3662595]: Disconnected from invalid user hamza 167.71.128.40 port 48756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 11 17:22:18 host2 sshd[3662930]: Disconnected from invalid user rock 167.71.128.40 port 46368 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 11 17:23:46 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<NuX7y6tFvpy8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-11 17:24:47 dovecot_plain authenticator failed for (thrilen) [46.10.210.68]:41179: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 11 17:25:35 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<R3ow0qtF3L2l6LP6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-12-11 17:25:55 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:41211: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-12-11 17:26:00 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:49872: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 17:25:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<wwfo06tFVIIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-11 17:26:11 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:52993: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-11 17:26:13 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:35860: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-11 17:27:21 dovecot_login authenticator failed for ([180.94.75.110]) [180.94.75.110]:43297: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-11 17:27:42 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:51502: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 11 17:27:45 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<HpI82qtFQoDO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 11 17:28:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<cvEJ3qtFMqU+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 17:29:00 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Ipes3qtFQJAro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 17:29:21 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<lO/k36tFlqE+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 11 17:30:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<KubU5KtFZAovTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-11 17:31:46 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:58474: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.62
country_id: 2186224
description:
2025-12-11 17:32:09 dovecot_login authenticator failed for ([121.73.162.62]) [121.73.162.62]:52100: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 17:33:05 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<3oRC7atFRJFnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 11 17:33:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<sa5Y7atF+swrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-12-11 17:32:28 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:58464: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2025-12-11 17:32:57 dovecot_login authenticator failed for ([103.130.207.227]) [103.130.207.227]:54318: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 11 17:34:07 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Eqj28KtFaKEzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.17.221
country_id: 1269750
description:
Dec 11 17:36:29 host2 sshd[3673073]: Disconnected from invalid user nadia 103.118.17.221 port 32900 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-11 17:36:50 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:26514: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 17:36:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (datorral) [87.103.126.54]:23766: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-12-11 17:37:13 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:52078: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 11 17:38:44 host2 sshd[3675400]: Disconnected from invalid user username 205.185.125.150 port 40002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 11 17:39:22 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<cfjNA6xFMqU+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 17:39:16 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<YC5rA6xFoMsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.136.231.166
country_id: 1814991
description:
Dec 11 17:39:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=8.136.231.166, lip=66.85.158.91, session=<y0+aA6xF+sMIiOem>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Dec 11 17:41:02 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<WKO4CaxF/psI3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 11 17:41:10 host2 sshd[3677505]: Disconnected from invalid user milad 205.185.125.150 port 37646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 17:41:21 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<XcfnCqxF4pUvT+mI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-11 17:41:43 dovecot_login authenticator failed for ([177.236.146.222]) [177.236.146.222]:44623: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-11 17:41:57 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:42799: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.17.221
country_id: 1269750
description:
Dec 11 17:42:08 host2 sshd[3678419]: Disconnected from invalid user test 103.118.17.221 port 57830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 11 17:43:11 host2 sshd[3679210]: Disconnected from invalid user rony 103.82.240.194 port 33860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 11 17:42:24 host2 sshd[3678592]: Disconnected from invalid user william 104.223.85.124 port 56058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.17.221
country_id: 1269750
description:
Dec 11 17:42:51 host2 sshd[3678903]: Disconnected from invalid user postgres 103.118.17.221 port 47800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 11 17:43:51 host2 sshd[3679624]: Disconnected from invalid user nadia 103.82.240.194 port 44376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 11 17:44:08 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<KDHQFKxFdOjIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-11 17:44:09 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (hemits) [73.168.136.150]:57444: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 11 17:43:26 host2 sshd[3679406]: Disconnected from invalid user wangke 104.223.85.124 port 40010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.254
country_id: 6252001
description:
Dec 11 17:45:08 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.188.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<J7+KGKxFKOos3Lz+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.17.221
country_id: 1269750
description:
Dec 11 17:44:14 host2 sshd[3679898]: Disconnected from invalid user michel 103.118.17.221 port 53720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-11 17:44:25 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (famory) [174.166.153.20]:47704: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 11 17:44:27 host2 sshd[3680009]: Disconnected from invalid user milad 103.82.240.194 port 41232 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 17:44:55 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lX6bF6xFTtVnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-11 17:45:54 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:6064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-11 17:45:39 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:57837: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 17:45:53 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=</b8SG6xFaIpnsX0d>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.223.85.124
country_id: 6251999
description:
Dec 11 17:46:30 host2 sshd[3682071]: Received disconnect from 104.223.85.124 port 44148:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 11 17:46:36 host2 sshd[3682262]: Disconnected from invalid user bounce 205.185.125.150 port 45872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 11 17:47:48 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<byHtIaxFON4+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.162.62
country_id: 3144096
description:
2025-12-11 17:50:12 dovecot_login authenticator failed for (62-162-97-62.cust.smartcall.no) [62.97.162.62]:41925: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 11 17:49:50 host2 sshd[3685170]: Disconnected from invalid user wc 205.185.125.150 port 56454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 11 17:50:15 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<LhC7KqxFtN4+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-11 17:50:24 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:56758: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-11 17:50:23 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:33997: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-12-11 17:50:41 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:46367: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 11 17:51:47 host2 sshd[3687256]: Disconnected from invalid user wh 143.198.85.84 port 33132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-11 17:51:56 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:43360: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-11 17:51:18 dovecot_login authenticator failed for (75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:49661: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.167
country_id: 1835841
description:
Dec 11 17:51:22 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.244.42.167, lip=66.85.158.91, TLS, session=<HeXQLqxF9pCt9Cqn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.102.27.93
country_id: 3144096
description:
Dec 11 17:51:22 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=82.102.27.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I6fPLqxF5pBSZhtd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 11 17:53:57 host2 sshd[3688591]: Disconnected from invalid user user 66.116.199.234 port 45726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 11 17:53:40 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<tgjsNqxFKKxnoNQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 11 17:54:14 host2 sshd[3688957]: Disconnected from invalid user iot 194.107.115.2 port 22528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 11 17:54:48 host2 sshd[3689498]: Disconnected from invalid user ubuntu 143.198.85.84 port 51996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2025-12-11 17:56:05 dovecot_login authenticator failed for ([27.123.104.102]) [27.123.104.102]:38832: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 11 17:56:13 host2 sshd[3690728]: Disconnected from invalid user luis 20.102.116.25 port 41276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.54
country_id: 1269750
description:
2025-12-11 17:55:48 dovecot_login authenticator failed for ([182.79.86.54]) [182.79.86.54]:44374: 535 Incorrect authentication data (set_id=sales@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-11 17:55:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52699: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 11 17:56:35 host2 sshd[3690986]: Disconnected from invalid user admin 194.107.115.2 port 16796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 11 17:56:56 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<TW2dQqxFXJ8+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-11 17:56:23 dovecot_plain authenticator failed for (puncatuncy) [12.150.243.22]:36428: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.188.65.233
country_id: 2921044
description:
2025-12-11 17:56:26 dovecot_plain authenticator failed for (quehanten) [64.188.65.233]:46554: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Dec 11 17:57:31 host2 sshd[3691883]: Disconnected from invalid user ftpuser 74.87.117.147 port 25337 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 17:57:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<+UTeRaxF1Mg+PIdl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 11 17:57:21 host2 sshd[3691677]: Disconnected from invalid user zxy 66.116.199.234 port 58362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec 11 17:59:05 host2 sshd[3693159]: Disconnected from invalid user tesla 143.198.85.84 port 50206 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 11 17:58:22 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<QbG8R6xFQusvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 11 17:58:25 host2 sshd[3692650]: Disconnected from invalid user postgres 161.248.200.9 port 35952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 11 17:58:28 host2 sshd[3692702]: Disconnected from invalid user holu 194.107.115.2 port 54866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Dec 11 17:58:50 host2 sshd[3692960]: Disconnected from invalid user postgre 74.87.117.147 port 4434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.87.117.147
country_id: 6252001
description:
Dec 11 17:59:30 host2 sshd[3693521]: Disconnected from invalid user webuser 74.87.117.147 port 25976 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-11 18:00:58 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (nomanic) [37.150.8.174]:44957: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 11 18:01:31 host2 sshd[3695527]: Disconnected from invalid user postgres 20.102.116.25 port 59812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 11 18:02:03 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<tz3pVKxFJtmWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 11 18:02:37 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<9g3iVqxFSNtnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 18:02:56 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<NTAPWKxFvI8+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 11 18:03:31 host2 sshd[3697245]: Disconnected from invalid user dc 161.248.200.9 port 36234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-11 18:05:04 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:46228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 11 18:04:15 host2 sshd[3697704]: Disconnected from invalid user user 161.248.200.9 port 36272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-11 18:04:48 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:43384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-11 18:05:44 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:59066: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-11 18:06:15 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:36500: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 18:06:43 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<NcudZaxFys4+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 18:08:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<42SxbaxFHJYvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 11 18:09:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=</HJqcKxFgrw+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-12-11 18:09:46 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:52934: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-11 18:10:27 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:53894: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 11 18:10:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<j7/Bc6xFAOUv8Dk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-11 18:10:44 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (mized) [67.172.54.29]:33000: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 11 18:11:14 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<piu8daxFxixniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-11 18:11:52 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (undona) [85.225.19.144]:59324: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 18:12:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oa1ge6xFaogv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 18:13:40 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<DM92fqxFNLQro2np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.169.214
country_id: 6252001
description:
Dec 11 18:14:14 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.169.214, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uFaggKxFYrsUQanW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-11 18:14:26 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:59306: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.146.49.206
country_id: 6252001
description:
2025-12-11 18:14:34 dovecot_login authenticator failed for ([216.146.49.206]) [216.146.49.206]:50440: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-11 18:14:36 dovecot_login authenticator failed for a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:54914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-11 18:14:49 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:55540: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-11 18:15:51 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:43582: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-11 18:16:24 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:52994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.79.82
country_id: 6252001
description:
Dec 11 18:17:27 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.79.82, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oQUWjKxFwOUUDk9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 11 18:17:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<EhNnjKxFzpCPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 18:18:22 host2 sshd[3710100]: Disconnected from invalid user user 2.57.121.25 port 50090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 18:20:00 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<lGIZlaxFkrYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-11 18:20:12 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:37070: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-11 18:20:59 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:48696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-11 18:20:23 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:40006: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.130.246
country_id: 617790
description:
Dec 11 18:22:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=178.175.130.246, lip=66.85.158.91, TLS, session=<IxS9nKxFwoSyr4L2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.149
country_id: 1835841
description:
Dec 11 18:22:06 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.42.149, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TM69nKxFtoSt9CqV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 18:22:05 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<VYyTnKxFzs4+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-11 18:21:17 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:47379: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 18:21:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<phC3m6xFkrM+PIdc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 18:22:23 host2 sshd[3713026]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 11 18:23:26 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<s+JaoaxF3rw+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 11 18:24:42 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<hNXjpaxFtoBnmSo4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-11 18:25:20 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (abesobb) [98.193.112.85]:52460: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 11 18:27:15 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<gsMDr6xFIqaG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-11 18:27:36 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (patravels) [98.193.112.85]:34108: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 11 18:29:22 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<UVabtqxFFsE+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 18:29:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<zqjttqxFAK8+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec 11 18:30:01 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<gYfkuKxFzus+PIcp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 18:30:50 host2 sshd[3720243]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 11 18:30:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<ZuPmu6xFFqWkXGTY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2025-12-11 18:30:20 dovecot_login authenticator failed for (aes-static-137.135.17.125.airtel.in) [182.95.228.10]:54830: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-11 18:30:31 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:44064: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.131.233
country_id: 6252001
description:
Dec 11 18:31:54 host2 sshd[3721169]: Disconnected from invalid user vpn 206.217.131.233 port 41366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 11 18:31:27 host2 sshd[3720725]: Disconnected from invalid user vpn 37.252.188.15 port 33756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 11 18:32:27 host2 sshd[3721586]: Disconnected from invalid user pujie 187.110.238.50 port 54980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 11 18:32:33 host2 sshd[3721686]: Disconnected from invalid user xiaoxiao 37.252.188.15 port 58888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 11 18:33:02 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<wUC6w6xFtpE+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 11 18:33:04 host2 sshd[3722147]: Disconnected from invalid user localadmin 37.252.188.15 port 43222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 11 18:32:14 host2 sshd[3721421]: Disconnected from invalid user dangulo 79.59.175.196 port 55916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 18:33:18 host2 sshd[3722299]: Disconnected from invalid user user 2.57.121.25 port 14195 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 11 18:33:36 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<1hrWxaxFiE9ChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-12-11 18:33:43 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:59045: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.217
country_id: 3996063
description:
2025-12-11 18:34:05 dovecot_login authenticator failed for ([177.239.164.217]) [177.239.164.217]:57028: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.131.233
country_id: 6252001
description:
Dec 11 18:34:08 host2 sshd[3723506]: Disconnected from invalid user PRUEBA 206.217.131.233 port 40126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 11 18:33:30 host2 sshd[3722518]: Disconnected from invalid user csgoserver 79.59.175.196 port 56040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-11 18:33:49 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:39364: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2025-12-11 18:33:50 dovecot_login authenticator failed for ([49.124.154.170]) [49.124.154.170]:41748: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-11 18:34:24 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:45674: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-11 18:34:45 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:57428: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-11 18:35:06 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:53674: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-11 18:34:22 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:52092: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 11 18:34:42 host2 sshd[3724071]: Disconnected from invalid user localadmin 79.59.175.196 port 56168 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 11 18:35:03 host2 sshd[3724501]: Received disconnect from 37.252.188.15 port 37014:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 18:36:05 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<B42fzqxFeJNnJFMP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.59.175.196
country_id: 3175395
description:
Dec 11 18:35:16 host2 sshd[3724768]: Disconnected from invalid user op 79.59.175.196 port 42094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.131.233
country_id: 6252001
description:
Dec 11 18:36:16 host2 sshd[3725714]: Disconnected from invalid user appuser 206.217.131.233 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 11 18:36:21 host2 sshd[3725785]: Disconnected from invalid user vpn 187.110.238.50 port 44674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 11 18:36:47 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<wHQd0axFsqQ+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 11 18:37:05 host2 sshd[3726451]: Disconnected from invalid user geonode 103.217.144.161 port 51592 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.66
country_id: 2635167
description:
Dec 11 18:38:02 host2 dovecot[3293415]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.66, lip=66.85.158.92, TLS, session=<7f6x1axFnby594lC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 18:37:13 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<5cyy0qxF8MQ+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 11 18:37:21 host2 sshd[3726674]: Disconnected from invalid user enter 103.179.56.9 port 41122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 11 18:37:39 host2 sshd[3726995]: Disconnected from invalid user op 187.110.238.50 port 41240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 11 18:37:58 host2 sshd[3727302]: Disconnected from invalid user ubuntu 103.217.144.161 port 55466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-11 18:38:24 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (phippuril) [24.23.125.83]:49508: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 11 18:38:45 host2 sshd[3728069]: Disconnected from invalid user username 103.217.144.161 port 59304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 11 18:39:16 host2 sshd[3728596]: Disconnected from invalid user factorio 103.179.56.9 port 37798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.214.168
country_id: 3469034
description:
2025-12-11 18:39:28 dovecot_login authenticator failed for ([191.59.214.168]) [191.59.214.168]:38482: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-11 18:39:35 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:14368: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.250.25.214
country_id: 6252001
description:
Dec 11 18:39:39 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=195.250.25.214, lip=66.85.158.91, session=<6UpY26xFRL/D+hnW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-11 18:39:47 dovecot_login authenticator failed for (cm-84.211.13.178.get.no) [84.211.13.178]:56845: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.155.88.155
country_id: 2300660
description:
2025-12-11 18:39:56 dovecot_login authenticator failed for (88-155-41-155-dedicatedinternet.vodafone.com.gh) [41.155.88.155]:46142: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 11 18:41:04 host2 sshd[3730787]: Disconnected from invalid user vikas 103.226.139.139 port 41526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 11 18:40:17 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Sr6j3axFRqsv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-12-11 18:40:44 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:34540: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-12-11 18:40:56 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:55220: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 11 18:41:22 host2 sshd[3731049]: Disconnected from invalid user csgoserver 103.217.144.161 port 35288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 11 18:41:40 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<sbaV4qxFuIg+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 11 18:41:42 host2 sshd[3731349]: Disconnected from invalid user t1 103.179.56.9 port 41124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 18:41:44 host2 sshd[3731396]: Disconnected from invalid user  62.60.131.157 port 64839 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 11 18:42:32 host2 sshd[3732103]: Disconnected from invalid user PRUEBA 103.179.56.9 port 33968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 11 18:42:43 host2 sshd[3732263]: Disconnected from invalid user test1 103.226.139.139 port 39994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 11 18:42:47 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<8WeF5qxFQOA+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.90.88
country_id: 6252001
description:
Dec 11 18:43:19 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.71.90.88, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Hmig6KxFLsCnR1pY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 11 18:44:25 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<YTFW7KxFzK0+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.161
country_id: 1643084
description:
Dec 11 18:44:45 host2 sshd[3734052]: Disconnected from invalid user vpn 103.217.144.161 port 46118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-11 18:45:56 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:53338: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 11 18:46:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<h3dV8qxF9sc+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-11 18:45:39 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:54231: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 18:45:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<fR8a8axFouw+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-11 18:46:19 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:40646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.139
country_id: 1643084
description:
Dec 11 18:46:21 host2 sshd[3735968]: Disconnected from invalid user peter 103.226.139.139 port 47466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 18:46:46 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<4QnO9KxFmrQv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-11 18:46:49 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:49831: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 11 18:51:49 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<1aHbBq1F9IA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-11 18:51:50 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (butunnymet) [217.215.74.195]:47185: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-11 18:51:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aughte) [87.103.126.54]:6966: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 18:52:05 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<RvPUB61FVoYro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-11 18:52:08 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (plise) [73.27.33.174]:59066: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 11 18:53:09 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<rsieC61FCp2l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.235
country_id: 3865483
description:
Dec 11 18:52:59 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.109.235, lip=66.85.158.91, TLS, session=<x0u9Ca1FzZ6+tW3r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.195
country_id: 3175395
description:
Dec 11 18:53:20 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=194.60.212.195, lip=66.85.158.91, TLS, session=<24JOC61Fw53CPNTD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-11 18:53:32 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (uprotogual) [68.60.77.128]:44688: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-11 18:53:57 dovecot_plain authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:49675: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 11 18:54:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<vDB2EK1F5oozTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-11 18:55:07 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:46424: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec 11 18:55:27 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=206.238.42.137, lip=66.85.158.91, session=<jmbnE61FmtfO7iqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 11 18:55:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1vYJFK1FUi8vTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-12-11 18:55:40 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:46290: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-11 18:56:03 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:51057: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec 11 18:56:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<zkEZFq1F6o28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.3
country_id: 3469034
description:
Dec 11 18:56:54 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.240.37.3, lip=66.85.158.91, TLS, session=<YfYZGK1FL+i/8CUD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.186.16
country_id: 3996063
description:
2025-12-11 18:56:22 dovecot_login authenticator failed for (187.161.186.16-clientes-izzi.mx) [187.161.186.16]:57168: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.222
country_id: 3469034
description:
Dec 11 18:56:34 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.93.165.222, lip=66.85.158.91, TLS, session=<ovTfFq1FutKxXaXe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 11 18:58:04 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<JahBHa1F+Oc+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-11 18:59:57 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:55207: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 11 19:00:12 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<L4OwJK1F3IdnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Dec 11 18:59:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=43.155.16.105, lip=66.85.158.91, session=<VPsDI61FgLErmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec 11 19:00:20 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<yo1YJa1FfJ0v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-12-11 19:00:54 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:51512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.175.208.35
country_id: 3658394
description:
2025-12-11 19:02:03 dovecot_plain authenticator failed for ([89.116.164.85]) [181.175.208.35]:45724: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.224.180.88
country_id: 6251999
description:
2025-12-11 19:01:40 dovecot_plain authenticator failed for pool-99-224-180-88.cpe.net.cable.rogers.com ([89.116.164.85]) [99.224.180.88]:35332: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.253.43.224
country_id: 3996063
description:
2025-12-11 19:01:52 dovecot_plain authenticator failed for ([89.116.164.85]) [189.253.43.224]:53064: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 11 19:02:13 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<ZfAZLK1FeN8+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-11 19:02:51 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:50230: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.4
country_id: 3469034
description:
Dec 11 19:03:22 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.44.71.4, lip=66.85.158.91, TLS, session=<YAM6L61F0rmxLEcE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.42
country_id: 3175395
description:
Dec 11 19:03:40 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=185.15.171.42, lip=66.85.158.91, TLS, session=<ZD1pMK1Fwc65D6sq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-11 19:04:55 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (semurreass) [81.225.30.107]:37289: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-11 19:04:59 dovecot_login authenticator failed for (cm-84.211.14.36.get.no) [84.211.14.36]:37162: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.3.120.250
country_id: 2464461
description:
2025-12-11 19:05:17 dovecot_plain authenticator failed for ([89.116.164.85]) [197.3.120.250]:51252: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.61.121.136
country_id: 6252001
description:
2025-12-11 19:05:41 dovecot_plain authenticator failed for ([89.116.164.85]) [38.61.121.136]:34666: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-12-11 19:05:45 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:44958: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-11 19:06:03 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:33206: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.141.82.238
country_id: 3469034
description:
2025-12-11 19:05:30 dovecot_plain authenticator failed for 238-82-141-192.atendnetfibra.net.br ([89.116.164.85]) [192.141.82.238]:20082: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-11 19:05:44 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:33550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-11 19:05:47 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:41060: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 11 19:07:10 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<zAXBPa1FjMDIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-11 19:06:17 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:37216: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2025-12-11 19:06:38 dovecot_login authenticator failed for ([152.52.234.222]) [125.22.116.94]:44332: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-11 19:06:54 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:41310: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 19:07:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<QFgAP61F5IQ+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 19:07:41 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<5IabP61FBMsvT+mI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 11 19:09:55 host2 sshd[3756649]: Disconnected from invalid user usher 45.78.202.90 port 47346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Dec 11 19:09:16 host2 sshd[3756220]: Disconnected from invalid user usher 200.108.174.4 port 45870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Dec 11 19:17:25 host2 sshd[3762994]: Disconnected from invalid user admin1 200.108.174.4 port 41670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 11 19:18:19 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Ke+qZa1FutkvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 11 19:18:22 host2 sshd[3763690]: Disconnected from invalid user elena 118.194.230.231 port 41500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Dec 11 19:19:53 host2 sshd[3764781]: Disconnected from invalid user zhy 200.108.174.4 port 58574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec 11 19:20:13 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.160.212.28, lip=66.85.158.91, session=<vE96bK1FsrVnoNQc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 11 19:26:26 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<GICogq1Fmug+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 11 19:26:27 host2 sshd[3769818]: Disconnected from invalid user elena 45.78.202.90 port 38154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 11 19:26:51 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<uE80hK1FtMg+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-11 19:25:54 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:36735: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 11 19:26:00 host2 sshd[3769521]: Disconnected from invalid user admin 62.60.131.157 port 26017 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-11 19:26:13 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:33042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-11 19:27:00 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (paeabyles) [73.197.236.163]:51676: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 11 19:27:11 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<Ptdhha1FcsQ+PIdb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 11 19:27:31 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<ygiQhq1FlJxnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-11 19:28:41 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com (anulase) [24.97.253.246]:55486: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-11 19:30:30 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:48838: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 11 19:30:47 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<cF83kq1FHIg+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-11 19:30:53 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:55672: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-11 19:31:10 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:49154: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-11 19:32:05 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:54048: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 11 19:32:14 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<CJBZl61F+riWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-12-11 19:32:35 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:35406: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 19:32:38 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GjbimK1Fwpgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 11 19:33:25 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<zmanm61F+Js+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 11 19:33:42 host2 sshd[3775869]: Disconnected from invalid user user 2.57.121.25 port 7680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 11 19:34:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<vuJvn61FEqQ+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Dec 11 19:35:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<DcRVo61FjMRnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.233.136
country_id: 1880251
description:
Dec 11 19:35:34 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.79.233.136, lip=66.85.158.91, session=<NN1Uo61FxIMvT+mI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.240.57.60
country_id: 1819730
description:
Dec 11 19:36:46 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.240.57.60, lip=66.85.158.91, session=<lI2jp61Fjuwv8Dk8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-11 19:35:56 dovecot_plain authenticator failed for (gradrous) [102.53.15.18]:36130: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 11 19:36:00 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<7V3lpK1F5Mw+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 11 19:36:58 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<xRFhqK1FWpMro2np>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 11 19:37:19 host2 sshd[3778984]: Disconnected from invalid user testing 45.78.202.90 port 60896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-12-11 19:37:21 dovecot_login authenticator failed for ([128.185.247.254]) [125.19.158.2]:36146: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-11 19:37:36 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:55628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 11 19:37:44 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<cKIfq61Fj0lniu0S>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 11 19:38:39 host2 sshd[3779797]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 11 19:39:23 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<axIDsa1FvrqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 11 19:39:47 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<l9Nvsq1F/K4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.74
country_id: 3469034
description:
Dec 11 19:42:19 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=177.190.79.74, lip=66.85.158.91, TLS, session=<t8CAuq1FHI2xvk9K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.177.105
country_id: 3469034
description:
Dec 11 19:42:42 host2 dovecot[3293415]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=200.77.177.105, lip=66.85.158.91, TLS, session=<eoS+u61F7LPITbFp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 11 19:43:52 host2 sshd[3784326]: Disconnected from invalid user rootadmin 45.78.202.90 port 48110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 11 19:43:01 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<rtcEvq1FrqM+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-11 19:44:08 dovecot_plain authenticator failed for (rabless) [75.97.190.237]:46004: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-11 19:44:23 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:56953: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.188.65.233
country_id: 2921044
description:
2025-12-11 19:44:27 dovecot_plain authenticator failed for (intrap) [64.188.65.233]:46298: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-11 19:44:30 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:50806: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.16
country_id: 6252001
description:
2025-12-11 19:44:38 dovecot_login authenticator failed for ([98.185.120.16]) [98.185.120.16]:54884: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-11 19:44:40 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:53822: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.101
country_id: 6252001
description:
2025-12-11 19:44:54 dovecot_login authenticator failed for ([70.174.168.101]) [70.174.168.101]:34309: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 11 19:45:08 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<1f2Vxa1FDrw+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-11 19:45:30 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:42349: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.19
country_id: 6252001
description:
2025-12-11 19:46:36 dovecot_login authenticator failed for ([98.181.44.19]) [98.181.44.19]:53828: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.36.58
country_id: 3077311
description:
2025-12-11 19:46:52 dovecot_login authenticator failed for (ip-212-119-36-58.ipv4.m-wifi.cz) [212.119.36.58]:58516: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 11 19:49:30 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<UDwk1a1FAKQ+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.234
country_id: 6252001
description:
Dec 11 19:50:28 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.149.234, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<75jI2K1Fc8ai2JXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-11 19:50:32 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:60630: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-11 19:50:52 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:33925: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.128.164.205
country_id: 3865483
description:
2025-12-11 19:51:47 dovecot_plain authenticator failed for ([89.116.164.85]) [186.128.164.205]:53022: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.234
country_id: 6252001
description:
Dec 11 19:50:54 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.234, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<lOlT2q1FSPii2JXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-11 19:51:20 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (talmaers) [174.161.27.82]:38693: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-11 19:52:37 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:55970: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-11 19:52:46 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:60674: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.128.164.205
country_id: 3865483
description:
2025-12-11 19:51:54 dovecot_login authenticator failed for ([89.116.164.85]) [186.128.164.205]:53022: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-11 19:51:56 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:57464: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.1.71
country_id: 3865483
description:
2025-12-11 19:52:00 dovecot_plain authenticator failed for ([89.116.164.85]) [179.38.1.71]:60954: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.167.156.2
country_id: 3865483
description:
2025-12-11 19:52:15 dovecot_plain authenticator failed for ([89.116.164.85]) [181.167.156.2]:40802: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.166
country_id: 2413451
description:
2025-12-11 19:52:28 dovecot_login authenticator failed for (197-255-207-166.netpagedns.net) [197.255.207.166]:52391: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.44.145.83
country_id: 1694008
description:
Dec 11 19:53:45 host2 sshd[3791579]: Invalid user httpsaccounts.zoho.comsigninhr@lezzarotech.com from 143.44.145.83 port 26897


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 143.44.145.83
country_id: 1694008
description:
Dec 11 19:53:51 host2 pure-ftpd[3791577]: (?@143.44.145.83) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr@lezzarotech.com]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.100.216
country_id: 6252001
description:
Dec 11 19:53:16 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=164.92.100.216, lip=66.85.158.91, session=<JhKl4q1FRN+kXGTY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.153.42.56
country_id: 1643084
description:
Dec 11 19:53:37 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.153.42.56, lip=66.85.158.91, session=<vx3f461F4JBnmSo4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.44.145.83
country_id: 1694008
description:
Dec 11 19:53:44 host2 pure-ftpd[3791577]: (?@143.44.145.83) [INFO] New connection from 143.44.145.83


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.44.145.83
country_id: 1694008
description:
Dec 11 19:53:54 host2 pure-ftpd[3791661]: (?@143.44.145.83) [INFO] New connection from 143.44.145.83


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.44.145.83
country_id: 1694008
description:
Dec 11 19:54:02 host2 sshd[3791712]: Invalid user httpsaccounts.zoho.comsigninhr from 143.44.145.83 port 7277


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 11 19:54:37 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS handshaking: Connection closed, session=</geb561FQOdChJlw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-11 19:54:46 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (knulion) [174.59.253.88]:37696: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-11 19:55:30 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:40757: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-11 19:55:33 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:33271: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2025-12-11 19:55:54 dovecot_login authenticator failed for (nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:52836: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-11 19:56:06 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:48664: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.229.220.185
country_id: 6251999
description:
2025-12-11 19:57:02 dovecot_login authenticator failed for ([199.229.220.185]) [199.229.220.185]:49828: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-11 19:57:14 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:55994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-12-11 19:57:50 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:42432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.234
country_id: 6252001
description:
Dec 11 19:58:16 host2 dovecot[3293415]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.234, lip=66.85.158.91, TLS, session=<K4Ol9K1FSuWi2JXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-11 19:58:18 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:53806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


