# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.233.140.6
country_id: 3865483
description:
2025-12-14 14:09:29 dovecot_plain authenticator failed for ([89.116.164.85]) [45.233.140.6]:47361: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 14:11:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hiKJdeVFDs4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.84.145
country_id: 6252001
description:
2025-12-14 14:12:28 dovecot_plain authenticator failed for ([89.116.164.85]) [172.59.84.145]:51981: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.156.16
country_id: 3469034
description:
2025-12-14 14:12:41 dovecot_plain authenticator failed for 191-241-156-16-reverso.dstech.com.br ([89.116.164.85]) [191.241.156.16]:8535: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.24.74
country_id: 3686110
description:
2025-12-14 14:12:53 dovecot_plain authenticator failed for ([89.116.164.85]) [190.0.24.74]:49722: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-14 14:12:52 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:42878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-14 14:12:54 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (hannable) [76.157.219.158]:41300: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-12-14 14:13:07 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:53308: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.187.41.67
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.187.41.67 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.224.91.16
country_id: 6252001
description:
[2025-12-14 14:14:20 +0530] info [whostmgrd] 98.224.91.16 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.15.191
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.20.15.191 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.226.76
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.59.226.76 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.13.51
country_id: 3865483
description:
[2025-12-14 14:14:24 +0530] info [cpaneld] 186.22.13.51 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.19.223
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.22.19.223 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.52.21.229
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 122.52.21.229 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.228.44
country_id: 3469034
description:
2025-12-14 14:16:12 dovecot_plain authenticator failed for ([89.116.164.85]) [187.95.228.44]:16214: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.83.21.55
country_id: 6252001
description:
2025-12-14 14:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [97.83.21.55]:36756: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.50.47
country_id: 3865483
description:
2025-12-14 14:15:59 dovecot_plain authenticator failed for ([89.116.164.85]) [181.47.50.47]:60456: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-14 14:17:31 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:39230: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Dec 14 14:17:41 host2 sshd[2619701]: Disconnected from invalid user developer 172.245.92.99 port 47850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-14 14:17:02 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:33120: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.44.149.148
country_id: 3469034
description:
[2025-12-14 14:18:39 +0530] info [cpaneld] 187.44.149.148 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 90.160.139.163
country_id: 2510769
description:
Dec 14 14:18:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<eng@lezzarotech.com>, method=PLAIN, rip=90.160.139.163, lip=66.85.158.91, TLS, session=<lyNsjuVFwNdaoIuj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.212.200.144
country_id: 1880251
description:
Dec 14 14:18:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=20.212.200.144, lip=66.85.158.91, TLS, session=<5KNzjuVF580U1MiQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.22.173.1
country_id: 3469034
description:
[2025-12-14 14:18:38 +0530] info [whostmgrd] 177.22.173.1 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.174.79.224
country_id: 3895114
description:
[2025-12-14 14:18:33 +0530] info [cpaneld] 152.174.79.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.233.140.250
country_id: 3469034
description:
Dec 14 14:18:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=181.233.140.250, lip=66.85.158.91, session=<U+v0juVF2c616Yz6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Dec 14 14:18:38 host2 sshd[2619686]: Disconnected from invalid user marco 45.78.221.87 port 40398 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.0.212.58
country_id: 3865483
description:
[2025-12-14 14:18:43 +0530] info [cpaneld] 186.0.212.58 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.143.113
country_id: 3658394
description:
[2025-12-14 14:18:34 +0530] info [cpaneld] 45.236.143.113 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.255.208
country_id: 2542007
description:
Dec 14 14:18:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=154.144.255.208, lip=66.85.158.91, TLS, session=<AlhsjuVFyLeakP/Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Dec 14 14:18:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, TLS, session=<bRJojuVFOs8y6x8v>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.159.51
country_id: 1733045
description:
[2025-12-14 14:18:36 +0530] info [cpaneld] 161.142.159.51 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.71.116
country_id: 3469034
description:
[2025-12-14 14:18:41 +0530] info [cpaneld] 177.36.71.116 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.139.107.146
country_id: 1269750
description:
Dec 14 14:18:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=14.139.107.146, lip=66.85.158.91, session=<Zw11kOVFiNMOi2uS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 106.51.29.53
country_id: 1269750
description:
Dec 14 14:18:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=106.51.29.53, lip=66.85.158.91, TLS, session=<T6qWj+VF+IpqMx01>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.219.104.210
country_id: 3175395
description:
Dec 14 14:18:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng>, method=PLAIN, rip=188.219.104.210, lip=66.85.158.91, TLS, session=<VNeSj+VF2JW822jS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.255.209
country_id: 2542007
description:
Dec 14 14:19:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=154.144.255.209, lip=66.85.158.91, TLS, session=<J+kykOVFqJ6akP/R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.102.242
country_id: 290557
description:
Dec 14 14:19:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<engenv@lezzarotech.com>, method=PLAIN, rip=80.227.102.242, lip=66.85.158.91, TLS, session=<gIhakOVFZ8ZQ42by>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.148.165
country_id: 99237
description:
Dec 14 14:18:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env>, method=PLAIN, rip=65.20.148.165, lip=66.85.158.91, TLS, session=<t+GFj+VFD4hBFJSl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 71.41.202.12
country_id: 6252001
description:
Dec 14 14:18:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng.env@lezzarotech.com>, method=PLAIN, rip=71.41.202.12, lip=66.85.158.91, session=<oymrkOVFH8pHKcoM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.243.93
country_id: 2542007
description:
Dec 14 14:19:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=154.144.243.93, lip=66.85.158.91, TLS, session=<DvQykOVFPKKakPNd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.61.6
country_id: 290557
description:
Dec 14 14:19:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=5.32.61.6, lip=66.85.158.91, TLS, session=<oiTjkeVF/oIFID0G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.243.166.66
country_id: 3686110
description:
Dec 14 14:19:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=8.243.166.66, lip=66.85.158.91, session=<XxyckeVFlREI86ZC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Dec 14 14:19:27 host2 sshd[2620789]: Disconnected from invalid user intel 172.245.92.99 port 52914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 76.132.238.43
country_id: 6252001
description:
Dec 14 14:18:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=76.132.238.43, lip=66.85.158.91, session=<z+/rj+VFMpNMhO4r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.170.1.244
country_id: 3017382
description:
Dec 14 14:18:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<engenv@lezzarotech.com>, method=PLAIN, rip=176.170.1.244, lip=66.85.158.91, session=<mD7/j+VFn+WwqgH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 120.28.151.87
country_id: 1694008
description:
Dec 14 14:18:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=120.28.151.87, lip=66.85.158.91, session=<zgRNkOVFA8x4HJdX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.180.18.173
country_id: 130758
description:
Dec 14 14:19:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<enveng>, method=PLAIN, rip=2.180.18.173, lip=66.85.158.91, session=<aWLIkOVF5bcCtBKt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.233.70.88
country_id: 3469034
description:
Dec 14 14:19:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.233.70.88, lip=66.85.158.91, TLS, session=<PlBXkOVFAwi66UZY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.81
country_id: 732800
description:
Dec 14 14:19:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.253.159.81, lip=66.85.158.91, TLS, session=<h3GtkeVFo9S5/Z9R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.212.200.144
country_id: 1880251
description:
Dec 14 14:19:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=20.212.200.144, lip=66.85.158.91, session=<rILFkuVFBjAU1MiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.72.153.110
country_id: 290557
description:
Dec 14 14:18:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng.env@lezzarotech.com>, method=PLAIN, rip=91.72.153.110, lip=66.85.158.91, session=<VVvyj+VFI71bSJlu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 49.207.15.25
country_id: 1269750
description:
Dec 14 14:18:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=49.207.15.25, lip=66.85.158.91, session=<jY7yj+VFOcYxzw8Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.170.1.244
country_id: 3017382
description:
Dec 14 14:20:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=176.170.1.244, lip=66.85.158.91, session=<8PU5k+VFiOqwqgH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.194.243.187
country_id: 1269750
description:
Dec 14 14:20:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=103.194.243.187, lip=66.85.158.91, TLS, session=<C6eblOVFlYNnwvO7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.171.86.83
country_id: 3865483
description:
2025-12-14 14:20:23 dovecot_plain authenticator failed for ([89.116.164.85]) [181.171.86.83]:37420: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Dec 14 14:20:34 host2 sshd[2621653]: Disconnected from invalid user greek 172.245.92.99 port 52004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.145.215.49
country_id: 298795
description:
2025-12-14 14:20:36 dovecot_plain authenticator failed for ([89.116.164.85]) [31.145.215.49]:1945: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Dec 14 14:21:07 host2 sshd[2622077]: Disconnected from invalid user nami 172.245.92.99 port 54556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.102
country_id: 690791
description:
Dec 14 14:21:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=176.103.1.102, lip=66.85.158.91, TLS, session=<gc80mOVFPK+wZwFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.53
country_id: 2300660
description:
Dec 14 14:21:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=41.139.60.53, lip=66.85.158.91, TLS, session=<AmFtmeVFkrApizw1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.53.53.115
country_id: 718075
description:
2025-12-14 14:20:51 dovecot_plain authenticator failed for ([89.116.164.85]) [92.53.53.115]:4523: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec 14 14:20:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<4Imrl+VFSv7CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-14 14:22:18 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:34335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-14 14:22:23 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:58925: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-14 14:22:35 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:56906: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-14 14:23:10 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:56093: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-14 14:22:55 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:34990: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.239.254.117
country_id: 3469034
description:
2025-12-14 14:25:14 dovecot_plain authenticator failed for ([89.116.164.85]) [45.239.254.117]:51896: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.77.66
country_id: 1861060
description:
Dec 14 14:25:25 host2 sshd[2625217]: Disconnected from invalid user owner 172.207.77.66 port 1024 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.155.10.24
country_id: 6252001
description:
2025-12-14 14:25:02 dovecot_plain authenticator failed for dynamic-195-155-10-24.wireless.unwiredbb.net ([89.116.164.85]) [195.155.10.24]:40080: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.77.66
country_id: 1861060
description:
Dec 14 14:26:43 host2 sshd[2625931]: Disconnected from invalid user jack 172.207.77.66 port 1025 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-14 14:28:35 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:33815: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-14 14:28:05 dovecot_login authenticator failed for (aes-static-105.28.22.125.airtel.in) [182.95.228.22]:45696: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-14 14:28:53 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:52628: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 14:29:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4siWtOVFOrs+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.207.77.66
country_id: 1861060
description:
Dec 14 14:30:56 host2 sshd[2628718]: Disconnected from invalid user dolphinscheduler 172.207.77.66 port 1026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-14 14:32:49 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (warsedin) [37.150.8.174]:48973: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-14 14:34:01 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (coing) [68.52.119.193]:39346: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 14:34:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Y2PGx+VFbLg+PIdg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.26.104.212
country_id: 2635167
description:
Dec 14 14:35:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.26.104.212, lip=66.85.158.91, session=<ELD/yuVFtu92GmjU>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.26.104.212
country_id: 2635167
description:
Dec 14 14:35:17 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.26.104.212, lip=66.85.158.91, session=<HukRy+VFlvB2GmjU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.176.61.51
country_id: 3624060
description:
2025-12-14 14:36:41 dovecot_plain authenticator failed for ([89.116.164.85]) [186.176.61.51]:36032: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.176.61.51
country_id: 3624060
description:
2025-12-14 14:36:48 dovecot_login authenticator failed for ([89.116.164.85]) [186.176.61.51]:36032: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 14:37:12 host2 sshd[2631990]: Disconnected from invalid user  62.60.131.157 port 30106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-12-14 14:38:26 dovecot_login authenticator failed for (202.140.38.110.convergentindia.com) [202.140.38.110]:43401: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-14 14:38:41 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:49252: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 14:37:51 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (anker) [96.230.65.90]:40694: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 14:40:46 dovecot_plain authenticator failed for (minly) [5.31.23.133]:56740: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-14 14:41:16 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:33840: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 14:41:02 dovecot_login authenticator failed for ([182.78.70.126]) [182.78.70.126]:46078: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-14 14:42:07 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:37567: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-14 14:42:15 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:43006: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2025-12-14 14:42:23 dovecot_login authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:53440: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-14 14:43:05 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:50657: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-14 14:43:21 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:54245: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.99.144.28
country_id: 6252001
description:
[2025-12-14 14:44:22 +0530] info [cpaneld] 172.99.144.28 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-14 14:44:29 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (harnuon) [76.106.163.189]:35100: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-14 14:43:49 dovecot_login authenticator failed for ([130.185.96.113]) [130.185.96.113]:35628: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.93.151
country_id: 3865483
description:
[2025-12-14 14:44:04 +0530] info [cpaneld] 181.26.93.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 90.240.88.98
country_id: 2635167
description:
[2025-12-14 14:44:09 +0530] info [cpaneld] 90.240.88.98 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.186.70.236
country_id: 1733045
description:
[2025-12-14 14:44:19 +0530] info [cpaneld] 210.186.70.236 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.185.33
country_id: 3865483
description:
[2025-12-14 14:44:07 +0530] info [cpaneld] 181.46.185.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.169.34.236
country_id: 3469034
description:
[2025-12-14 14:44:16 +0530] info [whostmgrd] 45.169.34.236 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.21.131.190
country_id: 3469034
description:
[2025-12-14 14:44:21 +0530] info [cpaneld] 177.21.131.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-14 14:44:56 dovecot_plain authenticator failed for (ismathest) [24.187.213.29]:49514: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.249.149
country_id: 1733045
description:
2025-12-14 14:47:18 dovecot_plain authenticator failed for ([89.116.164.85]) [27.125.249.149]:29021: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.198.153
country_id: 3469034
description:
2025-12-14 14:47:32 dovecot_plain authenticator failed for ([89.116.164.85]) [131.100.198.153]:11874: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.85.208.201
country_id: 3437598
description:
2025-12-14 14:47:46 dovecot_plain authenticator failed for ([89.116.164.85]) [181.85.208.201]:48389: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-14 14:47:19 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:37828: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 14:47:40 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:45264: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.113.242.67
country_id: 3895114
description:
2025-12-14 14:47:43 dovecot_plain authenticator failed for ([89.116.164.85]) [191.113.242.67]:52836: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.72.52
country_id: 2260494
description:
2025-12-14 14:47:14 dovecot_plain authenticator failed for ([89.116.164.85]) [41.75.72.52]:25167: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.210.106.211
country_id: 1733045
description:
2025-12-14 14:47:29 dovecot_plain authenticator failed for ([89.116.164.85]) [113.210.106.211]:5794: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2025-12-14 14:47:40 dovecot_login authenticator failed for (ticons.static.gvt.net.br) [177.207.250.1]:40457: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.190.105.78
country_id: 3996063
description:
2025-12-14 14:48:18 dovecot_plain authenticator failed for fixed-187-190-105-78.totalplay.net ([89.116.164.85]) [187.190.105.78]:6258: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-14 14:48:20 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:38502: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.62.1.91
country_id: 1694008
description:
2025-12-14 14:48:30 dovecot_plain authenticator failed for ([89.116.164.85]) [158.62.1.91]:28949: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.215
country_id: 1733045
description:
2025-12-14 14:48:38 dovecot_login authenticator failed for ([49.124.152.215]) [49.124.152.215]:35078: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.113.242.67
country_id: 3895114
description:
2025-12-14 14:47:50 dovecot_login authenticator failed for ([89.116.164.85]) [191.113.242.67]:52836: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.234
country_id: 6252001
description:
Dec 14 14:47:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.234, lip=66.85.158.92, session=<dZLx9+VF/uTN0h/q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.85.208.201
country_id: 3437598
description:
2025-12-14 14:47:53 dovecot_login authenticator failed for ([89.116.164.85]) [181.85.208.201]:48389: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.107.250
country_id: 3895114
description:
2025-12-14 14:49:33 dovecot_plain authenticator failed for ([89.116.164.85]) [186.189.107.250]:53128: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.231.197.42
country_id: 6252001
description:
2025-12-14 14:49:08 dovecot_plain authenticator failed for ip68-231-197-42.oc.oc.cox.net ([89.116.164.85]) [68.231.197.42]:60888: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.98.100.86
country_id: 3469034
description:
2025-12-14 14:49:20 dovecot_plain authenticator failed for ([89.116.164.85]) [177.98.100.86]:57180: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-14 14:50:24 dovecot_plain authenticator failed for (prous) [65.20.174.63]:60975: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-14 14:50:21 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (tably) [98.227.25.115]:40368: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.239.180.230
country_id: 1694008
description:
2025-12-14 14:50:50 dovecot_plain authenticator failed for ([89.116.164.85]) [136.239.180.230]:44899: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.169.173.213
country_id: 3469034
description:
2025-12-14 14:51:03 dovecot_plain authenticator failed for ([89.116.164.85]) [45.169.173.213]:38260: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.35.115.83
country_id: 6252001
description:
2025-12-14 14:51:14 dovecot_plain authenticator failed for ([89.116.164.85]) [76.35.115.83]:20339: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.155
country_id: 6252001
description:
2025-12-14 14:53:05 dovecot_login authenticator failed for ([70.174.167.155]) [70.174.167.155]:56033: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.105
country_id: 1733045
description:
2025-12-14 14:53:23 dovecot_login authenticator failed for ([49.124.147.105]) [49.124.147.105]:54416: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2025-12-14 14:53:48 dovecot_login authenticator failed for (nsg-corporate-73.251.187.122.airtel.in) [122.187.251.73]:56646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-12-14 14:54:15 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:51482: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-14 14:55:44 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:47946: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-14 14:56:29 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:44099: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-14 14:58:20 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (inmal) [78.68.37.25]:58657: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 14:58:23 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (infer) [73.224.171.101]:55296: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.245
country_id: 6252001
description:
2025-12-14 15:03:06 dovecot_login authenticator failed for wsip-184-191-242-245.fv.ks.cox.net [184.191.242.245]:35637: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-14 15:03:27 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:47271: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-14 15:07:46 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (dacratess) [89.67.37.2]:50375: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-14 15:07:28 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:40850: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.121.205
country_id: 294640
description:
2025-12-14 15:07:42 dovecot_login authenticator failed for ([46.210.121.205]) [46.210.121.205]:45958: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.35.92.115
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.35.92.115 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.160.22.255
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.160.22.255 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.211.213
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 203.9.211.213 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.63
country_id: 2510769
description:
Dec 14 15:08:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.214.138.63, lip=66.85.158.91, TLS, session=<vtkRQuZFjJi51oo/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.226
country_id: 690791
description:
Dec 14 15:08:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=176.103.11.226, lip=66.85.158.91, TLS, session=<R1wMQuZFaaawZwvi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.137
country_id: 2510769
description:
Dec 14 15:09:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=185.145.43.137, lip=66.85.158.91, TLS, session=<lUkjQ+ZFJc65kSuJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.32
country_id: 798544
description:
Dec 14 15:09:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.125.248.32, lip=66.85.158.91, TLS, session=<5s5mQ+ZF3qFtffgg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.70
country_id: 3865483
description:
Dec 14 15:08:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.249.70, lip=66.85.158.91, TLS, session=<zMIWQuZF+aqzAPlG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.0.35.224
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.0.35.224 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.121.107
country_id: 6290252
description:
Dec 14 15:09:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=85.202.121.107, lip=66.85.158.91, TLS, session=<et1RQ+ZFaKdVynlr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.111.8
country_id: 798544
description:
Dec 14 15:09:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=91.196.111.8, lip=66.85.158.91, TLS, session=<+ogiQ+ZFQs9bxG8I>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.60.166.240
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.60.166.240 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.8.158.192
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 177.8.158.192 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.133
country_id: 933860
description:
Dec 14 15:08:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.216.215.133, lip=66.85.158.91, TLS, session=<+8sdQuZFQaMp2NeF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.37.191
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.114.37.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.145.63.230
country_id: 1694008
description:
2025-12-14 15:10:39 dovecot_plain authenticator failed for ([89.116.164.85]) [49.145.63.230]:52652: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.145.63.230
country_id: 1694008
description:
2025-12-14 15:10:46 dovecot_login authenticator failed for ([89.116.164.85]) [49.145.63.230]:52652: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.165.108.236
country_id: 1643084
description:
2025-12-14 15:10:54 dovecot_plain authenticator failed for ([89.116.164.85]) [125.165.108.236]:17784: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-14 15:11:07 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (spordoorms) [73.13.220.220]:59152: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.72
country_id: 6252001
description:
Dec 14 15:11:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.72, lip=66.85.158.92, TLS, session=<vx+jS+ZFwOSTuYRI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-14 15:12:05 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:60902: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-12-14 15:12:32 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:36459: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-14 15:12:38 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:60821: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-14 15:12:53 dovecot_login authenticator failed for (cm-84.211.6.119.get.no) [84.211.6.119]:40827: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-14 15:13:27 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:51444: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 15:13:36 dovecot_plain authenticator failed for (untics) [65.20.164.137]:60480: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 15:14:00 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (berid) [24.23.125.83]:48504: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.156
country_id: 6252001
description:
2025-12-14 15:14:10 dovecot_login authenticator failed for ([98.185.120.156]) [98.185.120.156]:33335: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 15:17:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<tyVGYOZFSLQ+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.194.193.205
country_id: 1694008
description:
2025-12-14 15:17:54 dovecot_plain authenticator failed for ([89.116.164.85]) [180.194.193.205]:58606: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.187.246.147
country_id: 3895114
description:
2025-12-14 15:18:08 dovecot_plain authenticator failed for ([89.116.164.85]) [201.187.246.147]:36645: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.4.117.16
country_id: 3865483
description:
2025-12-14 15:18:21 dovecot_plain authenticator failed for ([89.116.164.85]) [186.4.117.16]:39812: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-14 15:18:24 dovecot_login authenticator failed for ([182.66.214.70]) [182.66.214.70]:40506: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-14 15:18:44 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:33345: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.118.1
country_id: 3469034
description:
2025-12-14 15:19:32 dovecot_plain authenticator failed for 1.118.175.45.customer.neolink.com.br ([89.116.164.85]) [45.175.118.1]:50000: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-12-14 15:19:03 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:9635: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.131.218.56
country_id: 6252001
description:
2025-12-14 15:19:07 dovecot_plain authenticator failed for h69-131-218-56.cncrtn.broadband.dynamic.tds.net ([89.116.164.85]) [69.131.218.56]:33754: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.145.19.168
country_id: 298795
description:
2025-12-14 15:19:19 dovecot_plain authenticator failed for ([89.116.164.85]) [31.145.19.168]:54247: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-14 15:19:25 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:46823: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-14 15:20:00 dovecot_plain authenticator failed for (chail) [149.62.239.4]:52338: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 15:20:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<6A3kbeZFPpWB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 15:21:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<CnmUb+ZFSLI+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.151.34
country_id: 690791
description:
Dec 14 15:22:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.151.34, lip=66.85.158.91, TLS, session=<wwF3cuZFWtYl3Zci>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.65.239.26
country_id: 3469034
description:
Dec 14 15:22:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=45.65.239.26, lip=66.85.158.91, TLS, session=<H0kMdOZFNYktQe8a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 15:27:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<WO/mhOZFOME+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-14 15:28:56 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:47076: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-14 15:29:11 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:52625: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-14 15:29:31 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (roway) [73.129.57.71]:54410: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 15:31:55 host2 sshd[2669751]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-12-14 15:31:49 dovecot_plain authenticator failed for 5.185.198.73.ipv4.public.orange.pl (ganter) [5.185.198.73]:49098: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-14 15:33:15 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:44647: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-12-14 15:33:01 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:57252: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-14 15:34:38 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (yaplings) [76.145.10.140]:38166: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 15:34:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tfQgoOZFop6nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.163
country_id: 3658394
description:
2025-12-14 15:36:59 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.163]:39965: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.87.121.68
country_id: 6290252
description:
2025-12-14 15:37:13 dovecot_plain authenticator failed for 93-87-121-68.dynamic.isp.telekom.rs ([89.116.164.85]) [93.87.121.68]:5016: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.5.45.122
country_id: 3895114
description:
2025-12-14 15:37:23 dovecot_plain authenticator failed for ([89.116.164.85]) [190.5.45.122]:1605: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-14 15:37:29 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:44416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.74
country_id: 1149361
description:
2025-12-14 15:37:40 dovecot_login authenticator failed for ([149.54.51.74]) [149.54.51.74]:58186: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-14 15:37:51 dovecot_login authenticator failed for ([125.18.154.73]) [182.95.226.118]:46006: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.149.116
country_id: 3996063
description:
2025-12-14 15:38:44 dovecot_login authenticator failed for ([177.236.149.116]) [177.236.149.116]:55635: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-14 15:38:55 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:32986: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-14 15:38:55 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:36646: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-14 15:42:23 dovecot_plain authenticator failed for (chack) [81.0.54.119]:53323: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-14 15:43:40 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:35232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-12-14 15:43:29 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:42310: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-14 15:44:23 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:59298: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.160.247
country_id: 3144096
description:
2025-12-14 15:44:46 dovecot_login authenticator failed for ([62.97.160.247]) [62.97.160.247]:48651: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.130.74
country_id: 3469034
description:
2025-12-14 15:45:21 dovecot_plain authenticator failed for ([89.116.164.85]) [177.125.130.74]:10606: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.100.46.252
country_id: 6252001
description:
2025-12-14 15:45:33 dovecot_plain authenticator failed for ip68-100-46-252.dc.dc.cox.net ([89.116.164.85]) [68.100.46.252]:34146: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.146.32.126
country_id: 6252001
description:
[2025-12-14 15:46:46 +0530] info [cpaneld] 69.146.32.126 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.61.135.67
country_id: 3865483
description:
[2025-12-14 15:46:53 +0530] info [whostmgrd] 186.61.135.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.204.244
country_id: 3996063
description:
[2025-12-14 15:46:54 +0530] info [cpaneld] 187.190.204.244 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.146.175.110
country_id: 1269750
description:
[2025-12-14 15:46:57 +0530] info [cpaneld] 103.146.175.110 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.114.198.119
country_id: 3895114
description:
[2025-12-14 15:46:59 +0530] info [cpaneld] 191.114.198.119 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.213.240
country_id: 1733045
description:
[2025-12-14 15:46:48 +0530] info [cpaneld] 113.211.213.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.19.143.145
country_id: 1694008
description:
[2025-12-14 15:46:51 +0530] info [cpaneld] 113.19.143.145 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:48:57 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<PmKS0uZF/rsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:51:13 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<fhij2uZFIpcDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-14 15:52:27 dovecot_plain authenticator failed for (deous) [5.11.221.119]:52898: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:53:07 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<R/Rz4eZFBs0DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-12-14 15:53:26 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:53248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:55:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<He4E6eZFhp4DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:55:21 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<X/N16eZFWuEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-14 15:56:14 dovecot_plain authenticator failed for (pilisly) [176.113.155.132]:39721: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:55:52 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<5c9N6+ZF3qEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 14 15:57:16 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<g1NI8OZFOuIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.239.238.23
country_id: 732800
description:
2025-12-14 15:57:33 dovecot_login authenticator failed for ([178.239.238.23]) [178.239.238.23]:50262: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-14 15:57:44 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:60434: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 15:58:31 host2 sshd[2690648]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.118.149.190
country_id: 1562822
description:
[2025-12-14 15:58:00 +0530] info [cpaneld] 42.118.149.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.40.92.61
country_id: 3895114
description:
[2025-12-14 15:58:05 +0530] info [whostmgrd] 186.40.92.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.166.9.29
country_id: 1643084
description:
[2025-12-14 15:58:07 +0530] info [cpaneld] 125.166.9.29 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.41.33.191
country_id: 3175395
description:
[2025-12-14 15:58:09 +0530] info [cpaneld] 93.41.33.191 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.34.1
country_id: 1282988
description:
2025-12-14 15:58:42 dovecot_plain authenticator failed for ([89.116.164.85]) [111.119.34.1]:7066: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.62.57.148
country_id: 1733045
description:
[2025-12-14 15:58:03 +0530] info [cpaneld] 182.62.57.148 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.179.147.93
country_id: 3865483
description:
[2025-12-14 15:58:11 +0530] info [cpaneld] 201.179.147.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.81.70
country_id: 6252001
description:
[2025-12-14 15:57:58 +0530] info [cpaneld] 35.150.81.70 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.249.149.25
country_id: 3469034
description:
2025-12-14 15:59:09 dovecot_plain authenticator failed for 186-249-149-25.shared.desktop.com.br ([89.116.164.85]) [186.249.149.25]:27457: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.34.1
country_id: 1282988
description:
2025-12-14 15:58:49 dovecot_login authenticator failed for ([89.116.164.85]) [111.119.34.1]:7066: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.38.19.121
country_id: 3469034
description:
2025-12-14 15:58:56 dovecot_plain authenticator failed for ([89.116.164.85]) [177.38.19.121]:45634: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-14 16:01:48 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:43692: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2025-12-14 16:02:03 dovecot_login authenticator failed for (nsg-corporate-88.249.187.122.airtel.in) [122.187.249.88]:42648: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2025-12-14 16:02:14 dovecot_login authenticator failed for ([49.124.153.42]) [49.124.153.42]:46452: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.19.177.117
country_id: 2510769
description:
2025-12-14 16:02:25 dovecot_login authenticator failed for 117.red-88-19-177.staticip.rima-tde.net [88.19.177.117]:36149: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-14 16:03:07 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:40544: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.8.165
country_id: 1269750
description:
2025-12-14 16:03:21 dovecot_login authenticator failed for (abts-tn-static-165.8.185.136.airtelbroadband.in) [136.185.8.165]:56413: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-14 16:05:17 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (adving) [174.169.224.27]:56128: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-14 16:07:42 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:42542: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-14 16:07:55 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:53592: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-14 16:08:51 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:63765: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-14 16:09:07 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:35203: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-14 16:09:23 dovecot_login authenticator failed for ([135.13.8.246]) [74.224.215.23]:10182: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.86.115
country_id: 2215636
description:
2025-12-14 16:15:13 dovecot_plain authenticator failed for ([89.116.164.85]) [165.16.86.115]:55858: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.203.133.187
country_id: 3469034
description:
2025-12-14 16:15:27 dovecot_plain authenticator failed for ([89.116.164.85]) [186.203.133.187]:42682: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.189.98.46
country_id: 3895114
description:
2025-12-14 16:15:40 dovecot_plain authenticator failed for ([89.116.164.85]) [186.189.98.46]:5094: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-14 16:17:14 dovecot_plain authenticator failed for (toporisby) [65.20.164.137]:49477: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2025-12-14 16:17:08 dovecot_plain authenticator failed for host-188-11-17-169.business.telecomitalia.it (phanigart) [188.11.17.169]:52744: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-14 16:17:52 dovecot_login authenticator failed for (182.239.78.49.hk.chinamobile.com) [182.239.78.49]:14600: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-14 16:18:29 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:48097: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.111.229
country_id: 3144096
description:
2025-12-14 16:21:25 dovecot_login authenticator failed for (cm-178.232.111.229.get.no) [178.232.111.229]:44980: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-14 16:21:38 dovecot_login authenticator failed for (nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:58184: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 16:21:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<YjJHSOdFTJg+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-14 16:22:49 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:52579: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.23
country_id: 6252001
description:
2025-12-14 16:23:05 dovecot_login authenticator failed for ([98.181.46.23]) [98.181.46.23]:56798: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.21.151.21
country_id: 2802361
description:
2025-12-14 16:23:10 dovecot_plain authenticator failed for 78-21-151-21.access.telenet.be (etled) [78.21.151.21]:42340: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-14 16:25:21 dovecot_plain authenticator failed for (gurratin) [92.62.243.174]:43891: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-14 16:25:24 dovecot_plain authenticator failed for (whambin) [176.113.155.132]:44324: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-14 16:26:24 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:52246: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-14 16:26:44 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:35959: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-14 16:26:20 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:58970: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.215
country_id: 3996063
description:
2025-12-14 16:27:27 dovecot_login authenticator failed for ([177.236.145.215]) [177.236.145.215]:44973: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-14 16:27:58 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:52234: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.53.237
country_id: 587116
description:
2025-12-14 16:30:22 dovecot_plain authenticator failed for ([89.116.164.85]) [78.111.53.237]:57701: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.206.124.57
country_id: 99237
description:
2025-12-14 16:30:35 dovecot_plain authenticator failed for ([89.116.164.85]) [185.206.124.57]:26149: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-14 16:32:16 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:45558: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-14 16:32:51 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:40566: 535 Incorrect authentication data (set_id=contato@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-14 16:33:02 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:40390: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 14 16:34:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lF1ndedFEukDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 16:34:53 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (dostao) [73.224.171.101]:54830: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 14 16:37:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7IOzfudFGtYDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 16:37:30 dovecot_plain authenticator failed for (copet) [102.53.15.180]:59806: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-14 16:36:57 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (stral) [50.74.136.134]:48300: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 14 16:38:40 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<YkxYhOdFkK0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 14 16:40:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qMXkiedF2rcDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-14 16:40:19 dovecot_plain authenticator failed for (eabled) [103.51.26.198]:58313: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-14 16:41:57 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:48312: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-14 16:42:12 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:40730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2025-12-14 16:42:21 dovecot_plain authenticator failed for c-71-229-43-123.hsd1.ga.comcast.net (plagbogen) [71.229.43.123]:50484: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.10.244.59
country_id: 1605651
description:
2025-12-14 16:42:48 dovecot_plain authenticator failed for cm-58-10-244-59.revip7.asianet.co.th ([89.116.164.85]) [58.10.244.59]:5349: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 14 16:42:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<b19Fk+dFwOMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.83.31
country_id: 1210997
description:
2025-12-14 16:43:03 dovecot_plain authenticator failed for ([89.116.164.85]) [103.190.83.31]:55332: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 16:43:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<xIwplOdF9NHCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.68.90
country_id: 3469034
description:
2025-12-14 16:43:16 dovecot_plain authenticator failed for ([89.116.164.85]) [191.5.68.90]:25991: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.208.122
country_id: 933860
description:
Dec 14 16:43:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.216.208.122, lip=66.85.158.91, TLS, session=<ChnJlOdFqJEp2NB6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.246
country_id: 3469034
description:
Dec 14 16:43:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.246.246, lip=66.85.158.91, TLS, session=<SjQWludFIJC60fb2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.85.65.205
country_id: 2750405
description:
[2025-12-14 16:45:34 +0530] info [cpaneld] 86.85.65.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.55.160
country_id: 3469034
description:
[2025-12-14 16:45:41 +0530] info [whostmgrd] 191.242.55.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.135.68.169
country_id: 3686110
description:
[2025-12-14 16:45:44 +0530] info [cpaneld] 181.135.68.169 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.247.41.123
country_id: 3865483
description:
[2025-12-14 16:45:33 +0530] info [cpaneld] 190.247.41.123 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.145.58
country_id: 6252001
description:
[2025-12-14 16:45:38 +0530] info [cpaneld] 45.48.145.58 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.42.96.120
country_id: 3469034
description:
[2025-12-14 16:45:43 +0530] info [cpaneld] 179.42.96.120 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.91.159.202
country_id: 6252001
description:
2025-12-14 16:45:42 dovecot_plain authenticator failed for ([89.116.164.85]) [68.91.159.202]:53918: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.62.143.113
country_id: 6252001
description:
[2025-12-14 16:45:45 +0530] info [cpaneld] 68.62.143.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.91.159.202
country_id: 6252001
description:
2025-12-14 16:45:48 dovecot_login authenticator failed for ([89.116.164.85]) [68.91.159.202]:53918: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.8.115.24
country_id: 6252001
description:
2025-12-14 16:45:52 dovecot_plain authenticator failed for 99-8-115-24.lightspeed.brbnca.sbcglobal.net ([89.116.164.85]) [99.8.115.24]:34152: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2025-12-14 16:46:01 dovecot_login authenticator failed for ([128.185.144.1]) [182.95.226.82]:54432: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.189.122.208
country_id: 3865483
description:
2025-12-14 16:46:04 dovecot_plain authenticator failed for ([89.116.164.85]) [190.189.122.208]:45531: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.164
country_id: 1733045
description:
2025-12-14 16:46:32 dovecot_login authenticator failed for ([49.124.154.164]) [49.124.154.164]:36510: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.217.170
country_id: 1168579
description:
2025-12-14 16:47:19 dovecot_plain authenticator failed for ([89.116.164.85]) [59.103.217.170]:30236: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.30.148.54
country_id: 3469034
description:
2025-12-14 16:47:33 dovecot_plain authenticator failed for ([89.116.164.85]) [191.30.148.54]:47567: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.141.34.227
country_id: 6252001
description:
2025-12-14 16:47:05 dovecot_plain authenticator failed for 47-141-34-227.bng01.sngr.ca.frontiernet.net ([89.116.164.85]) [47.141.34.227]:44678: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 16:47:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<UTzvpOdFxOPBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.49.193
country_id: 1282988
description:
2025-12-14 16:49:13 dovecot_plain authenticator failed for ([89.116.164.85]) [111.119.49.193]:1719: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.244.64
country_id: 1733045
description:
2025-12-14 16:49:34 dovecot_plain authenticator failed for ([89.116.164.85]) [27.125.244.64]:61720: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-14 16:50:26 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:49036: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-14 16:50:29 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (supyoston) [76.16.7.82]:55631: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-14 16:50:40 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:55670: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-14 16:50:51 dovecot_login authenticator failed for ([121.73.169.153]) [197.219.228.242]:51554: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-14 16:51:02 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:55710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2025-12-14 16:51:07 dovecot_login authenticator failed for (devserver.gaonsoft.com) [125.19.138.74]:56942: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.251.108.10
country_id: 6252001
description:
2025-12-14 16:51:29 dovecot_plain authenticator failed for 108-251-108-10.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.251.108.10]:52074: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-14 16:51:41 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:51082: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.133
country_id: 6252001
description:
2025-12-14 16:51:44 dovecot_login authenticator failed for wsip-184-191-250-133.fv.ks.cox.net [184.191.250.133]:45243: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.152.202.104
country_id: 1643084
description:
2025-12-14 16:51:46 dovecot_plain authenticator failed for ([89.116.164.85]) [202.152.202.104]:44192: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.62.248.21
country_id: 2921044
description:
[2025-12-14 16:51:52 +0530] info [cpaneld] 194.62.248.21 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 16:52:11 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:52416: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.152.202.104
country_id: 1643084
description:
2025-12-14 16:51:54 dovecot_login authenticator failed for ([89.116.164.85]) [202.152.202.104]:44192: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-14 16:53:14 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (ounal) [73.144.27.228]:44796: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 16:53:23 host2 sshd[2734663]: Disconnected from invalid user admin 2.57.121.112 port 5868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2025-12-14 16:54:00 dovecot_plain authenticator failed for (stran) [196.219.216.146]:45144: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-14 16:55:00 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:55434: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-14 16:55:18 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:45180: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-14 16:56:28 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:60180: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-14 16:57:03 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:54169: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-14 16:57:12 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:49904: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-14 16:57:14 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:36804: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.122.104.135
country_id: 3865483
description:
2025-12-14 16:57:33 dovecot_plain authenticator failed for ([89.116.164.85]) [186.122.104.135]:58159: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.203.65
country_id: 3895114
description:
2025-12-14 16:57:47 dovecot_plain authenticator failed for ([89.116.164.85]) [168.196.203.65]:57412: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.248
country_id: 6252001
description:
2025-12-14 16:57:51 dovecot_login authenticator failed for wsip-184-191-242-248.fv.ks.cox.net [184.191.242.248]:51689: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.59.148.81
country_id: 3686110
description:
2025-12-14 16:58:00 dovecot_plain authenticator failed for ([89.116.164.85]) [181.59.148.81]:1517: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-14 16:58:43 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (kable) [24.91.103.202]:50670: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.15.156.14
country_id: 1269750
description:
2025-12-14 17:01:06 dovecot_plain authenticator failed for ([89.116.164.85]) [47.15.156.14]:48776: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.185.11.32
country_id: 3469034
description:
2025-12-14 17:01:20 dovecot_plain authenticator failed for ([89.116.164.85]) [45.185.11.32]:45088: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.106.227.42
country_id: 294640
description:
2025-12-14 17:01:31 dovecot_plain authenticator failed for ([89.116.164.85]) [176.106.227.42]:41130: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.121.211.225
country_id: 3865483
description:
2025-12-14 17:01:36 dovecot_plain authenticator failed for ([89.116.164.85]) [168.121.211.225]:34953: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.222.50
country_id: 3439705
description:
2025-12-14 17:01:44 dovecot_plain authenticator failed for r186-53-222-50.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.222.50]:58732: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.102.231.46
country_id: 3996063
description:
2025-12-14 17:01:56 dovecot_plain authenticator failed for ([89.116.164.85]) [187.102.231.46]:58150: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-14 17:02:21 dovecot_plain authenticator failed for (supsism) [65.20.160.107]:49064: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.222.50
country_id: 3439705
description:
2025-12-14 17:01:51 dovecot_login authenticator failed for r186-53-222-50.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.222.50]:58732: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-14 17:03:04 dovecot_login authenticator failed for ([182.95.119.118]) [182.95.119.118]:54044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-12-14 17:03:55 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:57370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.172.61.78
country_id: 3895114
description:
2025-12-14 17:04:15 dovecot_plain authenticator failed for ([89.116.164.85]) [152.172.61.78]:54514: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.5.36.130
country_id: 3895114
description:
2025-12-14 17:04:28 dovecot_plain authenticator failed for ([89.116.164.85]) [190.5.36.130]:29928: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.255.238.227
country_id: 6252001
description:
2025-12-14 17:04:39 dovecot_plain authenticator failed for c-73-255-238-227.hsd1.fl.comcast.net ([89.116.164.85]) [73.255.238.227]:48020: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.41.28.20
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.41.28.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.93.156.239
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.93.156.239 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.130.3.45
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.130.3.45 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.58.231.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.58.231.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-14 17:04:58 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (sphols) [67.173.58.47]:57054: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.5.197
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.201.5.197 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.13.186.104
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.13.186.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.231.129.233
country_id: 3624060
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.231.129.233 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.108.102
country_id: 3865483
description:
Dec 14 17:06:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=190.181.108.102, lip=66.85.158.91, TLS, session=<cMY05+dFyOS+tWxm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-14 17:06:15 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:47013: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.119.63
country_id: 798544
description:
Dec 14 17:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=176.98.119.63, lip=66.85.158.91, TLS, session=<04zu5edFEZawYnc/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.215
country_id: 3865483
description:
Dec 14 17:08:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.181.101.215, lip=66.85.158.91, TLS, session=<eHyg7edF37S+tWXX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.46
country_id: 953987
description:
Dec 14 17:08:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.35.46, lip=66.85.158.91, TLS, session=<w0Pj7udF7pdmQCMu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-14 17:10:09 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:41294: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.149.2
country_id: 1210997
description:
2025-12-14 17:09:15 dovecot_plain authenticator failed for ([89.116.164.85]) [160.191.149.2]:47278: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.144.32.59
country_id: 1694008
description:
2025-12-14 17:09:30 dovecot_plain authenticator failed for ([89.116.164.85]) [49.144.32.59]:25924: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.46.71.221
country_id: 6252001
description:
2025-12-14 17:09:44 dovecot_plain authenticator failed for c-73-46-71-221.hsd1.fl.comcast.net ([89.116.164.85]) [73.46.71.221]:49334: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.247.216
country_id: 2782113
description:
Dec 14 17:09:51 host2 sshd[2746870]: Disconnected from invalid user ali 152.53.247.216 port 35466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-14 17:10:36 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:50382: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 17:10:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<8hsx9+dFFqU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.170.243.136
country_id: 3865483
description:
2025-12-14 17:15:11 dovecot_plain authenticator failed for ([89.116.164.85]) [152.170.243.136]:47462: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-14 17:14:54 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:35221: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-14 17:15:13 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:60036: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.247.216
country_id: 2782113
description:
Dec 14 17:15:15 host2 sshd[2751221]: Disconnected from invalid user jenkins 152.53.247.216 port 50762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.170.243.136
country_id: 3865483
description:
2025-12-14 17:15:18 dovecot_login authenticator failed for ([89.116.164.85]) [152.170.243.136]:47462: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-14 17:15:23 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:55964: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.18.164.78
country_id: 3469034
description:
2025-12-14 17:15:24 dovecot_plain authenticator failed for ([89.116.164.85]) [177.18.164.78]:54260: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-14 17:15:49 dovecot_login authenticator failed for 24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:44032: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-14 17:16:15 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:51084: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.53.247.216
country_id: 2782113
description:
Dec 14 17:16:28 host2 sshd[2751921]: Disconnected from invalid user root1 152.53.247.216 port 32838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-14 17:16:34 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:50395: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 17:17:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ad4gDuhFINU+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.247.216
country_id: 2782113
description:
Dec 14 17:17:27 host2 sshd[2752506]: Disconnected from invalid user testmail 152.53.247.216 port 39118 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:20:55 host2 sshd[2754958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-14 17:21:06 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:37009: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 17:21:07 host2 sshd[2755108]: Disconnected from invalid user admin 2.57.121.112 port 27532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-14 17:21:30 dovecot_login authenticator failed for ([202.90.133.142]) [202.90.133.142]:8421: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-14 17:21:38 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (nothrus) [98.222.93.199]:36344: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-14 17:21:41 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:44769: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.152.109
country_id: 2510769
description:
2025-12-14 17:21:58 dovecot_login authenticator failed for 109.82-130-152.dynamic.clientes.euskaltel.es [82.130.152.109]:56140: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.201.118.193
country_id: 3895114
description:
2025-12-14 17:23:14 dovecot_plain authenticator failed for ([89.116.164.85]) [128.201.118.193]:49156: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 17:23:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<VuZRJehF8oGB4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.184.13.169
country_id: 3469034
description:
2025-12-14 17:26:57 dovecot_plain authenticator failed for ([89.116.164.85]) [45.184.13.169]:41134: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.191.176.245
country_id: 1694008
description:
2025-12-14 17:27:12 dovecot_plain authenticator failed for ([89.116.164.85]) [180.191.176.245]:54994: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.190.138.191
country_id: 3996063
description:
2025-12-14 17:27:24 dovecot_plain authenticator failed for fixed-187-190-138-191.totalplay.net ([89.116.164.85]) [187.190.138.191]:49894: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 17:29:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<snxjOOhFtJ2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.222.127.149
country_id: 3996063
description:
2025-12-14 17:31:11 dovecot_plain authenticator failed for 189.222.127.149.dsl.dyn.telnor.net ([89.116.164.85]) [189.222.127.149]:33806: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-14 17:30:15 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (overpans) [73.55.194.114]:56764: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.192.210
country_id: 3595528
description:
2025-12-14 17:31:41 dovecot_login authenticator failed for (210.192.121.190.ispguatemala.com.gt) [190.121.192.210]:50016: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-14 17:31:15 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:47814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.222.127.149
country_id: 3996063
description:
2025-12-14 17:31:17 dovecot_login authenticator failed for 189.222.127.149.dsl.dyn.telnor.net ([89.116.164.85]) [189.222.127.149]:33806: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.228.141
country_id: 3865483
description:
2025-12-14 17:31:23 dovecot_plain authenticator failed for ([89.116.164.85]) [45.164.228.141]:37068: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.42.131.26
country_id: 298795
description:
2025-12-14 17:31:36 dovecot_plain authenticator failed for ([89.116.164.85]) [176.42.131.26]:23894: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:33:19 host2 sshd[2763795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:34:35 host2 sshd[2764833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.79
country_id: 6252001
description:
Dec 14 17:34:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=48.214.144.79, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bOg8S+hFbuow1pBP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-14 17:35:09 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:59796: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.101.89.119
country_id: 3469034
description:
2025-12-14 17:35:11 dovecot_plain authenticator failed for ([89.116.164.85]) [187.101.89.119]:43640: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:35:29 host2 sshd[2765678]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.232.166.136
country_id: 298795
description:
2025-12-14 17:35:34 dovecot_plain authenticator failed for ([89.116.164.85]) [176.232.166.136]:53254: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.101.89.119
country_id: 3469034
description:
2025-12-14 17:35:18 dovecot_login authenticator failed for ([89.116.164.85]) [187.101.89.119]:43640: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.188.96
country_id: 6252001
description:
2025-12-14 17:35:22 dovecot_plain authenticator failed for ([89.116.164.85]) [47.158.188.96]:59002: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.239.254.95
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.239.254.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-14 17:37:36 dovecot_plain authenticator failed for (inonsad) [176.113.155.132]:47721: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.179.60.195
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.179.60.195 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.99.8.7
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.99.8.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.148.242.15
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.148.242.15 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.245.251.208
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.245.251.208 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.161.103
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.231.161.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.97.133.103
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 86.97.133.103 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.88.48.34
country_id: 1327865
description:
2025-12-14 17:40:08 dovecot_plain authenticator failed for ([89.116.164.85]) [103.88.48.34]:7805: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-14 17:40:01 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:57159: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.88.48.34
country_id: 1327865
description:
2025-12-14 17:40:15 dovecot_login authenticator failed for ([89.116.164.85]) [103.88.48.34]:7805: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.47.46.60
country_id: 1168579
description:
2025-12-14 17:40:23 dovecot_plain authenticator failed for ([89.116.164.85]) [202.47.46.60]:14903: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.229.10.111
country_id: 3703430
description:
2025-12-14 17:40:36 dovecot_plain authenticator failed for ([89.116.164.85]) [200.229.10.111]:52210: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.227.20
country_id: 6252001
description:
Dec 14 17:41:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.118.227.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<mTByY+hF0uMUduMU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-14 17:41:04 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:38980: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-12-14 17:41:19 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:50365: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:45:42 host2 sshd[2771819]: Disconnected from invalid user webmaster 42.200.66.164 port 40866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.251
country_id: 3996063
description:
2025-12-14 17:45:47 dovecot_login authenticator failed for (201.173.216.251-clientes-izzi.mx) [201.173.216.251]:40225: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-14 17:46:00 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:35930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:46:22 host2 sshd[2772549]: Disconnected from invalid user business 42.200.66.164 port 52964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-14 17:46:29 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:55280: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-12-14 17:46:44 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:37526: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-14 17:47:09 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (mangar) [24.98.45.238]:48688: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 17:47:50 host2 sshd[2773319]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 14 17:47:39 host2 sshd[2773205]: Disconnected from invalid user narges 42.200.66.164 port 48926 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.198.84.44
country_id: 6252001
description:
2025-12-14 17:51:05 dovecot_plain authenticator failed for 67-198-84-44.dyn.grandenetworks.net ([89.116.164.85]) [67.198.84.44]:43805: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.144.186.165
country_id: 1655842
description:
2025-12-14 17:50:43 dovecot_plain authenticator failed for ([89.116.164.85]) [202.144.186.165]:42511: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.188.234.223
country_id: 3469034
description:
2025-12-14 17:50:53 dovecot_plain authenticator failed for ([89.116.164.85]) [200.188.234.223]:54113: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-12-14 17:54:20 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:45522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-12-14 17:54:30 dovecot_plain authenticator failed for (diess) [85.29.149.211]:48670: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-14 17:54:36 dovecot_login authenticator failed for ([84.211.13.69]) [84.211.13.69]:47616: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 17:54:42 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50103: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-14 17:55:56 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:48228: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 14 17:55:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<h7GSl+hF7NWLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.224
country_id: 6252001
description:
2025-12-14 17:56:15 dovecot_login authenticator failed for wsip-184-191-242-224.fv.ks.cox.net [184.191.242.224]:33498: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-14 17:58:25 dovecot_plain authenticator failed for (abilus) [5.11.141.74]:43346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-12-14 17:59:59 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:60738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.106
country_id: 2186224
description:
2025-12-14 18:00:14 dovecot_login authenticator failed for ([121.73.169.106]) [121.73.169.106]:46702: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.116.189.189
country_id: 953987
description:
2025-12-14 18:00:34 dovecot_plain authenticator failed for ([89.116.164.85]) [41.116.189.189]:51348: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-14 18:00:42 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (ottism) [98.193.112.85]:39472: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.46.8.131
country_id: 1643084
description:
2025-12-14 18:00:49 dovecot_plain authenticator failed for ([89.116.164.85]) [103.46.8.131]:60024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.91.177.217
country_id: 6254930
description:
2025-12-14 18:01:03 dovecot_plain authenticator failed for ([89.116.164.85]) [77.91.177.217]:49288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.121.39
country_id: 2264397
description:
2025-12-14 18:02:01 dovecot_plain authenticator failed for a109-51-121-39.cpe.netcabo.pt ([89.116.164.85]) [109.51.121.39]:33577: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.118.133
country_id: 1168579
description:
2025-12-14 18:02:03 dovecot_plain authenticator failed for ([89.116.164.85]) [59.103.118.133]:57006: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:08 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-14 18:01:43 dovecot_plain authenticator failed for (sauth) [65.20.184.80]:58471: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.167.160.142
country_id: 1694008
description:
2025-12-14 18:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [103.167.160.142]:40056: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.97.252.190
country_id: 3625428
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [190.97.252.190]:56563: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.41.105.7
country_id: 1327865
description:
2025-12-14 18:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [45.41.105.7]:19416: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.126.10.254
country_id: 3895114
description:
2025-12-14 18:02:14 dovecot_plain authenticator failed for ([89.116.164.85]) [191.126.10.254]:20109: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.38.84
country_id: 3895114
description:
2025-12-14 18:02:15 dovecot_login authenticator failed for ([89.116.164.85]) [190.114.38.84]:2309: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.69.14
country_id: 3469034
description:
2025-12-14 18:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.69.14]:35258: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.72.28.142
country_id: 3469034
description:
2025-12-14 18:02:21 dovecot_plain authenticator failed for 189-72-28-142.user3p.v-tal.net.br ([89.116.164.85]) [189.72.28.142]:44924: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.131.177.205
country_id: 6252001
description:
Dec 14 18:03:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@saara.lk>, method=PLAIN, rip=104.131.177.205, lip=66.85.158.91, session=<Y92Bs+hFQtpog7HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-14 18:04:35 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:33633: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-14 18:05:03 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:56390: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-14 18:05:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:51806: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.6.42
country_id: 2542007
description:
2025-12-14 18:06:03 dovecot_plain authenticator failed for ([89.116.164.85]) [105.72.6.42]:46096: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.16
country_id: 6252001
description:
2025-12-14 18:05:34 dovecot_login authenticator failed for ([98.181.44.16]) [98.181.44.16]:48042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.141.72.165
country_id: 3469034
description:
2025-12-14 18:05:50 dovecot_plain authenticator failed for cgnat-165.online.caxias.br ([89.116.164.85]) [192.141.72.165]:15537: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.20.157.14
country_id: 3865483
description:
2025-12-14 18:06:19 dovecot_plain authenticator failed for ([89.116.164.85]) [181.20.157.14]:37810: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.201.224
country_id: 1269750
description:
2025-12-14 18:06:35 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.201.224]:51730: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.32.121
country_id: 390903
description:
2025-12-14 18:06:46 dovecot_login authenticator failed for (149-210-32-121.mobile.nym.cosmote.net) [149.210.32.121]:47873: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 14 18:09:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<YvwqyOhFmARChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:10:50 host2 sshd[2789944]: Disconnected from invalid user develop 185.216.116.13 port 60456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-12-14 18:10:31 dovecot_login authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:33171: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-14 18:11:31 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:56242: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 18:11:43 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:52790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 14 18:12:08 host2 sshd[2790819]: Disconnected from invalid user scheduler 185.216.116.13 port 55592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-14 18:11:17 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:52554: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.2.16.39
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.2.16.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.181.2.190
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.181.2.190 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.232.22.112
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.232.22.112 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.139.89.152
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.139.89.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.15.51
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.185.15.51 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:12:32 host2 sshd[2791092]: Disconnected from invalid user idempiere 152.32.215.203 port 50728 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.236.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 207.135.236.151 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.0.13.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 131.0.13.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-14 18:12:48 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:59680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2025-12-14 18:13:13 dovecot_login authenticator failed for ([49.125.201.70]) [49.125.201.70]:33346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-14 18:13:31 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:52583: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:13:47 host2 sshd[2791861]: Disconnected from invalid user hik 152.32.215.203 port 33376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 14 18:14:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Y0RQ2uhFro8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:14:25 host2 sshd[2792211]: Disconnected from invalid user zhy 179.127.26.32 port 42464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:15:11 host2 sshd[2793036]: Disconnected from invalid user ubuntu 179.127.26.32 port 40674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:15:48 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:43562: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.127.26.32
country_id: 3469034
description:
Dec 14 18:16:41 host2 sshd[2794132]: Disconnected from invalid user yang 179.127.26.32 port 49168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-14 18:17:14 dovecot_login authenticator failed for (187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:46870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.130
country_id: 298795
description:
Dec 14 18:17:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@v-deploy.com>, method=PLAIN, rip=149.34.211.130, lip=66.85.158.91, TLS, session=<7m/w5ehFjOaVItOC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 14 18:18:15 host2 sshd[2795090]: Disconnected from invalid user sammy 152.32.215.203 port 50568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 14 18:18:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<Wwpb5+hF5IvJqAle>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-12-14 18:20:55 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:54359: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-14 18:20:44 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:56864: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 18:22:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<9EOq+OhFFNqB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Dec 14 18:24:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<zwWa/ehFVeBnpPaX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-14 18:24:36 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:59052: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-14 18:24:47 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:32568: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.93
country_id: 690791
description:
Dec 14 18:24:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=37.221.134.93, lip=66.85.158.91, TLS, session=<HUnd/uhFspgl3YZd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.199.231.110
country_id: 1282988
description:
2025-12-14 18:25:35 dovecot_plain authenticator failed for ([89.116.164.85]) [113.199.231.110]:15598: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.29.201.193
country_id: 3865483
description:
2025-12-14 18:25:49 dovecot_plain authenticator failed for ([89.116.164.85]) [181.29.201.193]:44393: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 16.98.109.97
country_id: 6252001
description:
2025-12-14 18:26:01 dovecot_plain authenticator failed for ([89.116.164.85]) [16.98.109.97]:28024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-14 18:29:07 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:45461: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-14 18:29:49 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:33550: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-12-14 18:29:33 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:57132: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.232.162.147
country_id: 3469034
description:
2025-12-14 18:30:51 dovecot_plain authenticator failed for 168-232-162-147.static.sumicity.net.br ([89.116.164.85]) [168.232.162.147]:15186: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:04 dovecot_plain authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.170.21
country_id: 3996063
description:
2025-12-14 18:30:11 dovecot_login authenticator failed for ([177.236.170.21]) [177.236.170.21]:38973: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.191
country_id: 6252001
description:
Dec 14 18:30:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.191, lip=66.85.158.91, session=<mtWpE+lFzNsUqwi/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.62.19
country_id: 3469034
description:
2025-12-14 18:31:11 dovecot_login authenticator failed for 186-236-62-19.viabol.com.br ([89.116.164.85]) [186.236.62.19]:34597: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.201.154.255
country_id: 3469034
description:
2025-12-14 18:31:17 dovecot_plain authenticator failed for ([89.116.164.85]) [128.201.154.255]:20354: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 18:31:18 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:27431: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 18:31:32 host2 sshd[2804623]: Disconnected from invalid user admin 2.57.121.112 port 52701 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.19.227
country_id: 953987
description:
2025-12-14 18:32:54 dovecot_plain authenticator failed for ([89.116.164.85]) [102.32.19.227]:51946: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:07 dovecot_plain authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.227.186
country_id: 3865483
description:
2025-12-14 18:33:14 dovecot_login authenticator failed for ([89.116.164.85]) [45.65.227.186]:54267: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 14 18:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, session=<L6k8HulFEhKnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.34.82
country_id: 3469034
description:
2025-12-14 18:33:23 dovecot_plain authenticator failed for ([89.116.164.85]) [177.67.34.82]:52742: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2025-12-14 18:35:54 dovecot_login authenticator failed for ([196.28.226.125]) [196.28.226.125]:57500: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-14 18:36:04 dovecot_plain authenticator failed for (judous) [38.248.111.238]:45731: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-14 18:36:07 dovecot_plain authenticator failed for (unicalle) [50.231.243.28]:52132: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-14 18:36:12 dovecot_plain authenticator failed for (nothagral) [102.53.15.180]:47626: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-14 18:36:14 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:43253: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 129.212.232.248
country_id: 1880251
description:
Dec 14 18:36:51 host2 pure-ftpd[2808217]: (?@129.212.232.248) [INFO] New connection from 129.212.232.248


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.135
country_id: 6252001
description:
Dec 14 18:37:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.154.135, lip=66.85.158.91, TLS: Connection closed, session=<NT7lLOlFcMHHLZqH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:42:13 host2 sshd[2811982]: Disconnected from invalid user User 213.142.151.19 port 41848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-14 18:45:58 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:59764: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-14 18:46:12 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:51614: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:47:02 host2 sshd[2815928]: Disconnected from invalid user valera 213.142.151.19 port 40726 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.134.119.200
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.134.119.200 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:48:16 host2 sshd[2816761]: Disconnected from invalid user connor 213.142.151.19 port 39608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 18:49:20 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57814: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-14 18:49:40 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:40547: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 14 18:50:09 host2 sshd[2818252]: Disconnected from invalid user vncuser 213.142.151.19 port 38630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.236.255.16
country_id: 6252001
description:
2025-12-14 18:51:28 dovecot_plain authenticator failed for c-71-236-255-16.hsd1.or.comcast.net ([89.116.164.85]) [71.236.255.16]:52102: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.152.14.222
country_id: 146669
description:
2025-12-14 18:51:40 dovecot_plain authenticator failed for cpe-985163.ip.primehome.com ([89.116.164.85]) [62.152.14.222]:44602: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.21.49.3
country_id: 3865483
description:
2025-12-14 18:51:53 dovecot_plain authenticator failed for ([89.116.164.85]) [181.21.49.3]:56124: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-14 18:54:47 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:41262: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-14 18:54:53 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:50927: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-14 18:54:28 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:59057: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-14 18:55:26 dovecot_login authenticator failed for (cm-84.210.149.45.get.no) [84.210.149.45]:46826: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-14 18:56:14 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:44024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.136.191.244
country_id: 2542007
description:
2025-12-14 18:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [105.136.191.244]:45123: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.195.22.145
country_id: 1694008
description:
2025-12-14 18:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [180.195.22.145]:51606: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 18:59:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<0uGKe+lF7tU+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 14 18:59:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=62.60.135.44, lip=66.85.158.91, session=<LJPffOlFLOg+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-12-14 19:00:45 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:58322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.138
country_id: 6252001
description:
2025-12-14 19:01:04 dovecot_login authenticator failed for wsip-184-191-250-138.fv.ks.cox.net [184.191.250.138]:55323: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-14 19:01:21 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:54193: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-14 19:01:41 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:60854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-14 19:01:56 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:34090: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-14 19:02:08 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:55526: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-14 19:05:47 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:52544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-12-14 19:06:17 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:38581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 19:08:22 host2 sshd[2830723]: Disconnected from invalid user violet 62.60.131.157 port 27734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 14 19:08:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<YcqtnOlF4qA+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:09:17 host2 sshd[2831381]: Disconnected from invalid user ociispth 162.240.39.179 port 59186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-14 19:10:45 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:34282: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:10:53 host2 sshd[2832857]: Disconnected from invalid user admin 162.240.39.179 port 59518 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:11:52 host2 sshd[2833495]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.84.186
country_id: 294640
description:
2025-12-14 19:11:12 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [2.54.84.186]:34930: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:11:25 host2 sshd[2833231]: Disconnected from invalid user dev 162.240.39.179 port 43690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-14 19:12:08 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (ulint) [73.208.81.125]:41374: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.163.186
country_id: 298795
description:
2025-12-14 19:12:11 dovecot_plain authenticator failed for ([89.116.164.85]) [81.214.163.186]:42816: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:13:36 host2 sshd[2834929]: Disconnected from invalid user runner 192.81.208.35 port 43920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-14 19:13:53 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:37102: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-14 19:14:03 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:50296: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-14 19:14:24 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:10596: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Dec 14 19:14:39 host2 sshd[2835740]: Disconnected from invalid user admin1 162.240.39.179 port 33420 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.51
country_id: 1733045
description:
2025-12-14 19:14:49 dovecot_login authenticator failed for ([49.124.153.51]) [49.124.153.51]:41794: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-12-14 19:15:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:35914: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:15:03 host2 sshd[2836151]: Disconnected from invalid user mrodelo 103.56.30.33 port 47816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:14 host2 sshd[2836381]: Disconnected from invalid user me 192.81.208.35 port 55748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.155
country_id: 6252001
description:
Dec 14 19:15:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.155, lip=66.85.158.92, session=<Z7ZRtelFYr2H7X2b>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:15:45 host2 sshd[2836787]: Disconnected from invalid user storage 192.81.208.35 port 40276 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 14 19:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<d7mDuelFLp2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-14 19:16:23 dovecot_login authenticator failed for (cm-178.232.188.10.get.no) [178.232.188.10]:39840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:16:29 host2 sshd[2837423]: Disconnected from invalid user runner 103.56.30.33 port 21480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-14 19:16:39 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:54686: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 14 19:17:57 host2 sshd[2838443]: Disconnected from invalid user me 103.56.30.33 port 41582 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:18:30 host2 sshd[2838833]: Received disconnect from 192.81.208.35 port 52294:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.49.242.200
country_id: 2510769
description:
2025-12-14 19:19:56 dovecot_login authenticator failed for 200.red-83-49-242.dynamicip.rima-tde.net [83.49.242.200]:43158: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-14 19:20:04 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:41873: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:20:11 host2 sshd[2840416]: Disconnected from invalid user test 102.210.149.121 port 47046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:20:13 host2 sshd[2840335]: Disconnected from invalid user mrodelo 45.78.202.90 port 45720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-14 19:20:24 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:54512: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-14 19:20:31 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:34042: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-14 19:20:45 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (monion) [76.106.163.189]:51492: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Dec 14 19:21:07 host2 sshd[2841308]: Disconnected from invalid user admin1 192.81.208.35 port 41510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-14 19:22:21 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:49002: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2025-12-14 19:21:22 dovecot_login authenticator failed for ([49.124.151.55]) [49.124.151.55]:40248: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-14 19:21:36 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:57953: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:22:24 host2 sshd[2842396]: Disconnected from invalid user automation 45.78.202.90 port 39000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:22:26 host2 sshd[2842437]: Disconnected from invalid user ubuntu 102.210.149.121 port 47942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:22:51 host2 sshd[2842694]: Disconnected from invalid user mary 43.166.245.172 port 54784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-14 19:23:06 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:42326: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Dec 14 19:24:11 host2 sshd[2843824]: Disconnected from invalid user ubuntu 102.210.149.121 port 48138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:23:38 host2 sshd[2843367]: Disconnected from invalid user k 205.185.126.121 port 54172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:24:53 host2 sshd[2844316]: Disconnected from invalid user es 205.185.126.121 port 51028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:25:27 host2 sshd[2844830]: Disconnected from invalid user Test 205.185.126.121 port 35338 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-14 19:25:51 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:37474: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:26:06 host2 sshd[2845333]: Disconnected from invalid user daniela 38.77.234.93 port 38640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-14 19:26:13 dovecot_login authenticator failed for ([128.185.217.84]) [128.185.239.182]:49302: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 14 19:26:40 host2 sshd[2845607]: Disconnected from invalid user admin1234 205.185.126.121 port 60422 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.191.182.211
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.191.182.211 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.241.68.24
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 88.241.68.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 19:26:41 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:38734: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.104.101
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.203.104.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.181.208.155
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.181.208.155 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-14 19:26:53 dovecot_login authenticator failed for ool-457e901e.dyn.optonline.net [69.126.144.30]:50050: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.39.208
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.4.39.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:14 host2 sshd[2845912]: Disconnected from invalid user user1 38.77.234.93 port 56286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.3.228.182
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.3.228.182 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.89.70.139
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.89.70.139 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 14 19:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<TF8q4ulFvr0+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:27:27 host2 sshd[2846063]: Disconnected from invalid user k 43.166.245.172 port 17152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.77.234.93
country_id: 6252001
description:
Dec 14 19:27:47 host2 sshd[2846243]: Disconnected from invalid user ubuntu 38.77.234.93 port 59500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Dec 14 19:29:17 host2 sshd[2846942]: Disconnected from invalid user storage 45.78.202.90 port 46406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.173.115.165
country_id: 3865483
description:
2025-12-14 19:28:24 dovecot_plain authenticator failed for ([89.116.164.85]) [190.173.115.165]:46625: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.245.208
country_id: 3865483
description:
2025-12-14 19:28:38 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.245.208]:46496: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.245.172
country_id: 6252001
description:
Dec 14 19:28:43 host2 sshd[2846694]: Disconnected from invalid user admin1234 43.166.245.172 port 11776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.21.189.208
country_id: 3017382
description:
2025-12-14 19:28:51 dovecot_plain authenticator failed for aorleans-652-1-3-208.w90-21.abo.wanadoo.fr ([89.116.164.85]) [90.21.189.208]:45686: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:29:50 host2 sshd[2847248]: Disconnected from invalid user mohammad 192.76.153.90 port 34616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:29:58 host2 sshd[2847312]: Disconnected from invalid user server 68.183.82.237 port 34182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:30:39 host2 sshd[2847868]: Disconnected from invalid user mcadmin 68.183.82.237 port 50958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:31:19 host2 sshd[2848216]: Disconnected from invalid user ubuntu 68.183.82.237 port 55282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-14 19:31:36 dovecot_plain authenticator failed for (dryballs) [109.226.14.93]:46888: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.76.153.90
country_id: 2750405
description:
Dec 14 19:32:06 host2 sshd[2848680]: Disconnected from invalid user noreply 192.76.153.90 port 34934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Dec 14 19:32:39 host2 sshd[2848906]: Disconnected from invalid user admin1234 68.183.82.237 port 44058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.194.235.86
country_id: 290557
description:
Dec 14 19:32:47 host2 sshd[2848955]: Disconnected from invalid user admin1234 5.194.235.86 port 55944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:32:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AOxr8+lFBt6i2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:33:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yJkX9+lF/PCi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:34:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<kR5++elFeOGi2JVE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:34:42 host2 sshd[2849795]: Disconnected from invalid user build 45.226.53.7 port 56398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:35:29 host2 sshd[2850390]: Disconnected from invalid user testuser 45.226.53.7 port 44764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.9
country_id: 3469034
description:
Dec 14 19:36:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.71.89.9, lip=66.85.158.91, TLS, session=<Pyys/elF6pOxR1kJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-14 19:36:12 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:48992: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-14 19:36:26 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:46560: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.176
country_id: 1269750
description:
Dec 14 19:36:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts>, method=PLAIN, rip=103.18.166.176, lip=66.85.158.91, TLS, session=<ndnw/ulFK71nEqaw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 19:38:38 host2 sshd[2852551]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 19:39:20 host2 sshd[2852981]: Disconnected from invalid user user 2.57.121.25 port 35908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.226.53.7
country_id: 3469034
description:
Dec 14 19:38:31 host2 sshd[2852480]: Disconnected from invalid user ubuntu 45.226.53.7 port 55326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.8.125.130
country_id: 3469034
description:
2025-12-14 19:40:18 dovecot_login authenticator failed for ([189.8.125.130]) [189.8.125.130]:47627: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.210.164
country_id: 2921044
description:
Dec 14 19:39:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.210.164, lip=66.85.158.91, TLS, session=<K4YzDOpFBo3PmtKk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-12-14 19:40:40 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:45994: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<oF1EFOpFhPmi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.68
country_id: 6252001
description:
Dec 14 19:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.68, lip=66.85.158.91, TLS, session=<uSVRFupFLvOi2JVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 14 19:44:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<20HCHOpFLKtAPpzU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.38.102.187
country_id: 130758
description:
2025-12-14 19:44:53 dovecot_plain authenticator failed for (doman) [89.38.102.187]:48126: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-14 19:45:13 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:52928: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:18 dovecot_plain authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-14 19:46:20 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:51214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:45:29 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:40160: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-12-14 19:45:35 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:3732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-14 19:45:45 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:38658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.168.38
country_id: 3469034
description:
2025-12-14 19:45:52 dovecot_plain authenticator failed for ([89.116.164.85]) [131.255.168.38]:50634: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.92.158.97
country_id: 3017382
description:
2025-12-14 19:46:04 dovecot_plain authenticator failed for 89-92-158-97.hfc.dyn.abo.bbox.fr ([89.116.164.85]) [89.92.158.97]:64094: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.0.23.20
country_id: 192950
description:
2025-12-14 19:46:25 dovecot_login authenticator failed for ([89.116.164.85]) [102.0.23.20]:35220: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.92
country_id: 3469034
description:
Dec 14 19:47:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=170.80.41.92, lip=66.85.158.91, TLS, session=<UkYMJepFTo2qUClc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.226
country_id: 3865483
description:
Dec 14 19:47:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.226, lip=66.85.158.91, TLS, session=<ecxLJupF2uezAPzi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-14 19:51:01 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:51976: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-14 19:51:22 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:35067: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 19:51:53 dovecot_login authenticator failed for (189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:59629: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.18
country_id: 6252001
description:
2025-12-14 19:52:17 dovecot_login authenticator failed for ([98.181.44.18]) [98.181.44.18]:37075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.123.109.115
country_id: 732800
description:
Dec 14 19:55:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=93.123.109.115, lip=66.85.158.91, TLS: Connection closed, session=<TuluQ+pFDs5de21z>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.31.178.148
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 103.31.178.148 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.165.30.251
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.165.30.251 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.200.33.40
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.200.33.40 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: error: maximum authentication attempts exceeded for root from 68.58.204.249 port 45268 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.164.43.129
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.164.43.129 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.155.240.207
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.155.240.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.189
country_id: 6252001
description:
Dec 14 19:56:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cGtMRupF1OMUQcG9>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:17 host2 sshd[2865719]: Disconnecting authenticating user root 68.58.204.249 port 45268: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.154.166.17
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.154.166.17 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.244.152.164
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.244.152.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.141.13.45
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.141.13.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:22 host2 sshd[2865795]: error: maximum authentication attempts exceeded for invalid user admin from 68.58.204.249 port 46302 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.5.117
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.168.5.117 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.49.16.163
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.49.16.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.170.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.118.170.89 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.53.2.142
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.53.2.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.58.204.249
country_id: 6252001
description:
Dec 14 19:56:23 host2 sshd[2865805]: Disconnecting invalid user admin 68.58.204.249 port 46310: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.67.230.52
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.67.230.52 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.178.247.14
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.178.247.14 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.86.164.242
country_id: 3625428
description:
2025-12-14 19:58:25 dovecot_plain authenticator failed for ([89.116.164.85]) [82.86.164.242]:16864: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.152.42.84
country_id: 192950
description:
2025-12-14 19:58:38 dovecot_plain authenticator failed for ([89.116.164.85]) [154.152.42.84]:54372: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.92.143.52
country_id: 1733045
description:
2025-12-14 19:58:54 dovecot_plain authenticator failed for ([89.116.164.85]) [219.92.143.52]:55820: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:19 dovecot_plain authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.225.186.148
country_id: 6252001
description:
2025-12-14 20:00:25 dovecot_login authenticator failed for 108-225-186-148.lightspeed.sntcca.sbcglobal.net ([89.116.164.85]) [108.225.186.148]:52080: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.33.157
country_id: 6252001
description:
2025-12-14 20:00:30 dovecot_plain authenticator failed for ([89.116.164.85]) [76.32.33.157]:5188: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 20:00:35 host2 sshd[2868800]: Disconnected from invalid user  62.60.131.157 port 28518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.33.138.26
country_id: 3469034
description:
2025-12-14 20:00:44 dovecot_plain authenticator failed for ([89.116.164.85]) [177.33.138.26]:14950: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-14 20:01:22 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:55732: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-12-14 20:01:41 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:56394: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:18 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 20:03:10 host2 sshd[2871042]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.42.141.241
country_id: 3895114
description:
2025-12-14 20:02:52 dovecot_plain authenticator failed for ([89.116.164.85]) [181.42.141.241]:16893: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.199.115
country_id: 1733045
description:
2025-12-14 20:02:25 dovecot_login authenticator failed for ([89.116.164.85]) [115.135.199.115]:28110: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.234.245.49
country_id: 2635167
description:
2025-12-14 20:02:29 dovecot_plain authenticator failed for haye-25-b2-v4wan-169431-cust5424.vm28.cable.virginm.net ([89.116.164.85]) [92.234.245.49]:53716: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.196.1
country_id: 1733045
description:
2025-12-14 20:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.196.1]:2737: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.166.137.22
country_id: 3508796
description:
2025-12-14 20:02:40 dovecot_plain authenticator failed for ([89.116.164.85]) [190.166.137.22]:54901: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.23.237.202
country_id: 3865483
description:
2025-12-14 20:02:42 dovecot_plain authenticator failed for ([89.116.164.85]) [186.23.237.202]:57916: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-14 20:04:46 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:36300: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.30.98
country_id: 1733045
description:
2025-12-14 20:04:55 dovecot_plain authenticator failed for ([89.116.164.85]) [115.135.30.98]:24219: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-14 20:05:02 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:53316: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.184.172.73
country_id: 953987
description:
2025-12-14 20:05:07 dovecot_plain authenticator failed for ([89.116.164.85]) [197.184.172.73]:19397: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:20 dovecot_plain authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.198
country_id: 6252001
description:
Dec 14 20:04:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.23.198, lip=66.85.158.91, TLS, session=<QN4TZOpFgucUHRfG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.53.24.21
country_id: 3439705
description:
2025-12-14 20:05:27 dovecot_login authenticator failed for r186-53-24-21.dialup.adsl.anteldata.net.uy ([89.116.164.85]) [186.53.24.21]:59630: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-14 20:05:54 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:51430: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.94.115.121
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 70.94.115.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.48.157.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 173.48.157.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.120.196.93
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.120.196.93 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.83.139.243
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.83.139.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.158.229.150
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.158.229.150 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.30.14.88
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 193.30.14.88 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.161.159.248
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 91.161.159.248 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:07:14 host2 sshd[2875362]: Disconnected from invalid user postgres 128.199.30.185 port 51986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:07:57 host2 sshd[2875977]: Disconnected from invalid user deployer 128.199.30.185 port 39474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.190
country_id: 3175395
description:
Dec 14 20:09:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.63.132.190, lip=66.85.158.91, TLS, session=<NplOdOpF9KS5P4S+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:09:18 host2 sshd[2877326]: Disconnected from invalid user eversec 128.199.30.185 port 60456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.231
country_id: 3469034
description:
Dec 14 20:08:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=186.209.247.231, lip=66.85.158.91, TLS, session=<2vaScupFVoK60ffn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 20:09:41 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (lepochs) [174.166.153.20]:36280: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.234
country_id: 3996063
description:
2025-12-14 20:10:09 dovecot_login authenticator failed for (201.173.216.234-clientes-izzi.mx) [201.173.216.234]:46301: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-14 20:10:15 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:57646: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.30.185
country_id: 1269750
description:
Dec 14 20:11:18 host2 sshd[2879364]: Disconnected from invalid user sean 128.199.30.185 port 37270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-14 20:10:27 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:54264: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-14 20:10:43 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:33104: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-14 20:11:33 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:47765: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.215.43.3
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.215.43.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.106.30.245
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.106.30.245 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.233.79.230
country_id: 1269750
description:
2025-12-14 20:16:05 dovecot_login authenticator failed for ([136.233.79.226]) [136.233.79.230]:47572: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.89.21
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.89.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.195.96.32
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.195.96.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.198.165
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.198.165 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.168.196.77
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.168.196.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.10.23.183
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.10.23.183 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.126.25
country_id: 3865483
description:
2025-12-14 20:16:20 dovecot_plain authenticator failed for ([89.116.164.85]) [181.47.126.25]:31564: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.107.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.41.107.246 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.47.126.25
country_id: 3865483
description:
2025-12-14 20:16:27 dovecot_login authenticator failed for ([89.116.164.85]) [181.47.126.25]:31564: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.159.74.64
country_id: 3469034
description:
2025-12-14 20:16:33 dovecot_plain authenticator failed for 201-159-74-64-dynamic.poxley.com.br ([89.116.164.85]) [201.159.74.64]:60378: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.33.118
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.43.33.118 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.78.29.216
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.78.29.216 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.205.2.15
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.205.2.15 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-12-14 20:17:09 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:49174: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-14 20:16:28 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:52248: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.255.179.119
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.255.179.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.172.68.215
country_id: 3351879
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.172.68.215 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.149.191.59
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.149.191.59 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.177.252.2
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.177.252.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 14 20:16:37 host2 sshd[2883459]: Disconnected from invalid user oracle 138.204.127.54 port 59360 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 169.224.19.86
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 169.224.19.86 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.20.22.218
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.20.22.218 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.228.234.149
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.228.234.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.18.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 186.22.18.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.112.216.139
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.112.216.139 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.106.38.150
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.106.38.150 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:18:03 host2 sshd[2884498]: Disconnected from invalid user runner 45.120.216.232 port 34694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.95.63.253
country_id: 3469034
description:
2025-12-14 20:18:08 dovecot_plain authenticator failed for ([89.116.164.85]) [179.95.63.253]:48956: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.33.226.237
country_id: 6251999
description:
2025-12-14 20:17:42 dovecot_plain authenticator failed for pool-173-33-226-237.cpe.net.cable.rogers.com ([89.116.164.85]) [173.33.226.237]:48693: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.140.24.63
country_id: 1522867
description:
2025-12-14 20:17:54 dovecot_plain authenticator failed for ([89.116.164.85]) [45.140.24.63]:26254: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.221.85
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.112.221.85 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.219.222
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.128.219.222 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.63.25.175
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.63.25.175 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.178.206.88
country_id: 2635167
description:
2025-12-14 20:19:16 dovecot_plain authenticator failed for host86-178-206-88.range86-178.btcentralplus.com ([89.116.164.85]) [86.178.206.88]:48206: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.36.37
country_id: 3469034
description:
2025-12-14 20:18:53 dovecot_plain authenticator failed for ([89.116.164.85]) [189.6.36.37]:35431: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.38.41.179
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 5.38.41.179 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.149.91.147
country_id: 3996063
description:
2025-12-14 20:19:05 dovecot_plain authenticator failed for ([89.116.164.85]) [187.149.91.147]:53300: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.201.244.91
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 62.201.244.91 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.25.20.13
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.25.20.13 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:19:21 host2 sshd[2885680]: Disconnected from invalid user deploy 45.120.216.232 port 59678 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.100.59
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.147.100.59 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.178.206.88
country_id: 2635167
description:
2025-12-14 20:19:23 dovecot_login authenticator failed for host86-178-206-88.range86-178.btcentralplus.com ([89.116.164.85]) [86.178.206.88]:48206: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:19:58 host2 sshd[2886098]: Disconnected from invalid user web1 45.120.216.232 port 43936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:20:20 host2 sshd[2886548]: Disconnected from invalid user username 172.173.117.246 port 41496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.120.216.232
country_id: 1819730
description:
Dec 14 20:20:37 host2 sshd[2886753]: Disconnected from invalid user admin 45.120.216.232 port 56428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:20:57 host2 sshd[2886988]: Disconnected from invalid user admin 198.98.56.205 port 42370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 14 20:20:33 host2 sshd[2886720]: Disconnected from invalid user admin 45.172.152.74 port 39586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 14 20:21:50 host2 sshd[2887712]: Disconnected from invalid user eric 45.172.152.74 port 51168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-14 20:21:51 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:56510: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 14 20:21:53 host2 sshd[2887736]: Disconnected from invalid user brandon 138.204.127.54 port 52333 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:22:04 host2 sshd[2887916]: Disconnected from invalid user admin 198.98.56.205 port 33726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.157
country_id: 3865483
description:
Dec 14 20:21:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.249.157, lip=66.85.158.91, TLS, session=<IY4EoOpFAYCzAPmd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.41
country_id: 798544
description:
Dec 14 20:21:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.236.172.41, lip=66.85.158.91, TLS, session=<Xs9noepFK5hb7Kwp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 20:23:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<H+qjpupFlIM+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:23:08 host2 sshd[2888681]: Disconnected from invalid user report 198.98.56.205 port 59344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-14 20:22:29 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:51590: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:22:26 host2 sshd[2888156]: Disconnected from invalid user admin 172.173.117.246 port 37336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-14 20:23:28 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (prophing) [174.166.153.20]:55750: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:23:56 host2 sshd[2889286]: Disconnected from invalid user zhangfeng 190.119.63.98 port 45051 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 14 20:24:11 host2 sshd[2889533]: Disconnected from invalid user user1 198.98.56.205 port 40068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.165
country_id: 3658394
description:
2025-12-14 20:25:12 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.165]:47007: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 14 20:24:32 host2 sshd[2889792]: Disconnected from invalid user admin 172.173.117.246 port 43276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.28.147.93
country_id: 3469034
description:
2025-12-14 20:24:38 dovecot_plain authenticator failed for ([89.116.164.85]) [189.28.147.93]:49734: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:24:41 host2 sshd[2889901]: Disconnected from invalid user gbasedbt 190.119.63.98 port 40363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.125.151.10
country_id: 1694008
description:
2025-12-14 20:24:56 dovecot_plain authenticator failed for ([89.116.164.85]) [103.125.151.10]:42288: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.214.5
country_id: 1733045
description:
2025-12-14 20:25:02 dovecot_plain authenticator failed for ([89.116.164.85]) [113.211.214.5]:37272: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 20:24:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<BShBrOpF6LA+PIdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.42.95.26
country_id: 1269750
description:
2025-12-14 20:24:40 dovecot_plain authenticator failed for ([89.116.164.85]) [49.42.95.26]:40310: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-14 20:26:05 dovecot_login authenticator failed for (177-174-16-81.user.vivozap.com.br) [177.174.16.55]:47782: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.78.85.229
country_id: 798549
description:
2025-12-14 20:26:09 dovecot_plain authenticator failed for ([89.116.164.85]) [82.78.85.229]:44484: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-14 20:26:17 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:55635: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:25:28 host2 sshd[2890726]: Disconnected from invalid user bob 190.119.63.98 port 54182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.188.115.193
country_id: 2378080
description:
2025-12-14 20:25:43 dovecot_plain authenticator failed for ([89.116.164.85]) [41.188.115.193]:17729: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.187.78.86
country_id: 99237
description:
2025-12-14 20:25:56 dovecot_plain authenticator failed for ([89.116.164.85]) [185.187.78.86]:48135: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.63.98
country_id: 3932488
description:
Dec 14 20:27:07 host2 sshd[2892020]: Disconnected from invalid user damien 190.119.63.98 port 27804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.93.3.185
country_id: 3469034
description:
2025-12-14 20:28:50 dovecot_plain authenticator failed for ([89.116.164.85]) [179.93.3.185]:57949: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.178.203.5
country_id: 3865483
description:
2025-12-14 20:29:05 dovecot_plain authenticator failed for ([89.116.164.85]) [201.178.203.5]:54012: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-14 20:29:53 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:57316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-14 20:30:05 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:58367: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 20:31:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<wFOFxOpF0Mw+PIdd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.232.123.136
country_id: 3469034
description:
2025-12-14 20:31:31 dovecot_plain authenticator failed for ([89.116.164.85]) [168.232.123.136]:24973: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec 14 20:31:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<47RixepFFsanXpI2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.226.108.136
country_id: 3865483
description:
2025-12-14 20:31:44 dovecot_plain authenticator failed for host136.190-226-108.telecom.net.ar ([89.116.164.85]) [190.226.108.136]:41657: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.176.236.2
country_id: 3865483
description:
2025-12-14 20:31:58 dovecot_plain authenticator failed for ([89.116.164.85]) [190.176.236.2]:40086: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 14 20:31:59 host2 pure-ftpd[2896232]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 14 20:32:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<b6uKyepFbMbCw3NV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.61.117.214
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.61.117.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.44.235
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 150.129.44.235 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.183.204.112
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.183.204.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.74.74.42
country_id: 1220409
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.74.74.42 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.96.127.131
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.96.127.131 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-14 20:34:41 dovecot_login authenticator failed for (201.172.89.74-clientes-izzi.mx) [201.172.89.74]:41487: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.106.73.119
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.106.73.119 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-14 20:35:12 dovecot_login authenticator failed for ([182.79.136.105]) [122.187.60.126]:58710: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.194.158.110
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.194.158.110 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-14 20:35:29 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:41407: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-14 20:35:43 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (antripsh) [24.23.125.83]:40388: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-14 20:35:47 dovecot_plain authenticator failed for (antelaed) [64.72.74.162]:38968: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-14 20:36:04 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:56012: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 14 20:36:54 host2 sshd[2900556]: Disconnected from invalid user admin 2.57.121.112 port 49762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-14 20:36:24 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:42249: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 14 20:38:06 host2 sshd[2901500]: Disconnected from invalid user finance 179.33.186.151 port 20670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.70.200.42
country_id: 6252001
description:
2025-12-14 20:37:25 dovecot_plain authenticator failed for ([89.116.164.85]) [99.70.200.42]:49809: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.138.56.154
country_id: 3996063
description:
2025-12-14 20:37:37 dovecot_plain authenticator failed for ([89.116.164.85]) [189.138.56.154]:45994: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:37:39 host2 sshd[2901125]: Disconnected from invalid user auditor 195.178.191.5 port 50928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:40:25 host2 sshd[2903836]: Disconnected from invalid user nino 104.244.74.84 port 43220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-14 20:40:42 dovecot_login authenticator failed for ([203.145.142.243]) [203.145.142.243]:41342: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.0.130.240
country_id: 953987
description:
2025-12-14 20:42:06 dovecot_plain authenticator failed for 169-0-130-240.ip.ahisp.co.za ([89.116.164.85]) [169.0.130.240]:39227: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.237.123.91
country_id: 99237
description:
2025-12-14 20:41:39 dovecot_plain authenticator failed for ([89.116.164.85]) [212.237.123.91]:15712: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-14 20:41:46 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:60686: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-14 20:41:27 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:50184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2025-12-14 20:41:39 dovecot_login authenticator failed for ([188.124.135.48]) [188.124.135.48]:45373: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:41:42 host2 sshd[2904945]: Disconnected from invalid user zomboid 104.244.74.84 port 38880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.29.110
country_id: 3686110
description:
2025-12-14 20:41:51 dovecot_plain authenticator failed for ([89.116.164.85]) [186.80.29.110]:15468: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:41:58 host2 sshd[2905186]: Received disconnect from 195.178.191.5 port 60466:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-12-14 20:41:22 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:44246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-14 20:41:25 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:48666: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Dec 14 20:42:23 host2 sshd[2905496]: Disconnected from invalid user hadoop 195.178.191.5 port 55954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-14 20:44:25 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:55310: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.159
country_id: 6252001
description:
2025-12-14 20:44:36 dovecot_login authenticator failed for ([98.185.120.159]) [98.185.120.159]:43540: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:44:52 host2 sshd[2907451]: Disconnected from invalid user openbravo 104.244.74.84 port 42112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Dec 14 20:46:16 host2 sshd[2908822]: Disconnected from invalid user es 104.244.74.84 port 37756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.171.2
country_id: 3923057
description:
2025-12-14 20:47:48 dovecot_plain authenticator failed for ([89.116.164.85]) [181.115.171.2]:1447: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.246.61
country_id: 630336
description:
2025-12-14 20:48:02 dovecot_plain authenticator failed for ([89.116.164.85]) [178.172.246.61]:60760: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.117.183.180
country_id: 3865483
description:
2025-12-14 20:47:35 dovecot_plain authenticator failed for host180.200-117-183.telecom.net.ar ([89.116.164.85]) [200.117.183.180]:38898: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 20:47:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<nlh+/upF0qg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-14 20:48:49 dovecot_plain authenticator failed for (emisping) [65.20.133.208]:51390: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-14 20:49:35 dovecot_plain authenticator failed for (uplamah) [91.73.188.251]:51337: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-14 20:49:37 dovecot_login authenticator failed for (wllk99-129-211.dsl.netins.net) [67.55.189.211]:56142: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2025-12-14 20:49:59 dovecot_login authenticator failed for ([49.124.152.247]) [49.124.152.247]:35918: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.214.60.28
country_id: 630336
description:
2025-12-14 20:50:41 dovecot_plain authenticator failed for ([89.116.164.85]) [37.214.60.28]:2631: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.128.123
country_id: 1269750
description:
2025-12-14 20:51:00 dovecot_plain authenticator failed for ([89.116.164.85]) [49.43.128.123]:35944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-14 20:51:03 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:44279: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.222.238.47
country_id: 298795
description:
2025-12-14 20:51:14 dovecot_plain authenticator failed for ([89.116.164.85]) [82.222.238.47]:52104: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-14 20:51:31 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:59266: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 20:55:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<+W4bG+tFKuM+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-14 20:55:46 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:57305: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.16.66.80
country_id: 3865483
description:
2025-12-14 20:56:46 dovecot_plain authenticator failed for ([89.116.164.85]) [181.16.66.80]:52768: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.232.131.175
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.232.131.175 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.46.164.241
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.46.164.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.221.173.30
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.221.173.30 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.12.168.204
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.12.168.204 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.20.225.138
country_id: 3923057
description:
2025-12-14 20:56:31 dovecot_plain authenticator failed for ([89.116.164.85]) [160.20.225.138]:36554: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.205.68.233
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.205.68.233 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.43.41
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.43.41 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.24.21.84
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.24.21.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.63.140
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.63.140 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-14 20:58:16 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:46747: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 20:59:14 host2 sshd[2921984]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-14 20:58:31 dovecot_login authenticator failed for (cm-84.211.13.69.get.no) [84.211.13.69]:58482: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 20:58:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Rb7aJutFzoQ+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.161
country_id: 3077311
description:
Dec 14 20:59:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=109.235.7.161, lip=66.85.158.91, TLS, session=<CUJrJutFCu5t6weh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.16.25
country_id: 2300660
description:
Dec 14 20:59:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.16.25, lip=66.85.158.91, TLS, session=<tFSGJ+tF9IApixAZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 20:59:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<9iclKutFMM0+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-14 21:00:04 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:34303: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-14 21:00:13 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:34114: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-14 21:00:20 dovecot_login authenticator failed for ([182.95.58.130]) [182.95.58.130]:39550: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-12-14 21:00:24 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:34228: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-14 21:01:12 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (lefleta) [71.62.34.216]:46036: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-14 21:01:20 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:40956: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.223
country_id: 3469034
description:
Dec 14 21:01:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=190.89.136.223, lip=66.85.158.91, TLS, session=<cXCILutFS7K+WYjf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.200
country_id: 1269750
description:
Dec 14 21:01:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info>, method=PLAIN, rip=103.18.166.200, lip=66.85.158.91, TLS, session=<PmDyL+tFNOJnEqbI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-14 21:01:51 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:43022: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-14 21:03:22 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:36397: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-14 21:04:09 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:38053: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 21:04:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<FdLCO+tFVMw+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:04:59 host2 sshd[2927582]: Disconnected from invalid user msf 141.95.162.162 port 44562 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.203.128
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.232.203.128 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.193.240.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.193.240.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.180.218.202
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.180.218.202 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.230.205.95
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 201.230.205.95 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.0.114.49
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 143.0.114.49 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:06:20 host2 sshd[2929533]: Disconnected from invalid user backend 158.69.213.129 port 44410 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.5
country_id: 798549
description:
Dec 14 21:05:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LntUPutFfJFV2YwF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.41.34.26
country_id: 298795
description:
2025-12-14 21:06:01 dovecot_plain authenticator failed for ([89.116.164.85]) [176.41.34.26]:41674: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.190
country_id: 3469034
description:
Dec 14 21:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.209.249.190, lip=66.85.158.91, TLS, session=<ZNkBPetFhIS60fm+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-14 21:06:08 dovecot_login authenticator failed for ([41.59.229.6]) [41.59.229.6]:42108: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.24.51.217
country_id: 3469034
description:
2025-12-14 21:05:40 dovecot_plain authenticator failed for ([89.116.164.85]) [177.24.51.217]:53916: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.88
country_id: 3865483
description:
Dec 14 21:05:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=179.0.250.88, lip=66.85.158.91, TLS, session=<3lRHPutFauazAPpY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 21:05:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<mq8UQOtFYKM+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.43.84
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.116.43.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.9.210.159
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 203.9.210.159 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Dec 14 21:06:30 host2 sshd[2929657]: Disconnected from invalid user alex 206.189.130.118 port 47682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:06:40 host2 sshd[2929803]: Disconnected from invalid user admin 141.95.162.162 port 42936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:06:51 host2 sshd[2929944]: Disconnected from invalid user amin 102.176.81.29 port 52448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2025-12-14 21:06:52 dovecot_login authenticator failed for ([117.205.2.9]) [117.205.2.9]:49808: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-14 21:06:28 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:39469: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:07:25 host2 sshd[2930498]: Disconnected from invalid user baran 158.69.213.129 port 47858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-14 21:07:30 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46021: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:07:37 host2 sshd[2930645]: Disconnected from invalid user misp 102.176.81.29 port 38834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 14 21:07:42 host2 sshd[2930722]: Disconnected from invalid user alex 141.95.162.162 port 56522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 14 21:09:04 host2 sshd[2932062]: Disconnected from invalid user sri 102.176.81.29 port 39810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-14 21:08:24 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:49984: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:08:28 host2 sshd[2931483]: Disconnected from invalid user malik 158.69.213.129 port 52740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.44
country_id: 6252001
description:
2025-12-14 21:08:33 dovecot_login authenticator failed for ([70.174.168.44]) [70.174.168.44]:53212: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Dec 14 21:10:05 host2 sshd[2933162]: Disconnected from invalid user user 158.69.213.129 port 42960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 21:09:45 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (unfunturod) [96.230.65.90]:42780: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:09:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<vJajTetFRNpDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 21:10:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<YC0hUetFYIo+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.177.169.196
country_id: 6252001
description:
Dec 14 21:10:57 host2 sshd[2934103]: Disconnected from invalid user siteadmin 52.177.169.196 port 37868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-14 21:11:15 dovecot_plain authenticator failed for (evelly) [102.53.15.17]:52039: 535 Incorrect authentication data (set_id=test@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:11:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<IR4hVOtF7otDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 21:11:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<whYKVOtFHJM+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 21:12:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<+VcEVutFatc+PIdh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.177.169.196
country_id: 6252001
description:
Dec 14 21:12:56 host2 sshd[2935814]: Disconnected from invalid user xw 52.177.169.196 port 52354 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 21:13:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<8UeXWutFaIQ+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.86.32.61
country_id: 3686110
description:
2025-12-14 21:14:02 dovecot_plain authenticator failed for ([89.116.164.85]) [186.86.32.61]:11497: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.36.110
country_id: 3469034
description:
2025-12-14 21:14:13 dovecot_plain authenticator failed for ([89.116.164.85]) [170.83.36.110]:7681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.142.245
country_id: 3469034
description:
2025-12-14 21:14:26 dovecot_plain authenticator failed for 131-0-142-245.virtualnetminas.com.br ([89.116.164.85]) [131.0.142.245]:12286: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 21:14:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<qFHJX+tFnOY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-12-14 21:16:14 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:38415: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.153.232.98
country_id: 298795
description:
2025-12-14 21:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [85.153.232.98]:36251: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-14 21:16:28 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:61629: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.218.145.184
country_id: 6252001
description:
2025-12-14 21:16:36 dovecot_plain authenticator failed for 184.sub-97-218-145.myvzw.com ([89.116.164.85]) [97.218.145.184]:41506: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.11.169.201
country_id: 3469034
description:
2025-12-14 21:17:50 dovecot_plain authenticator failed for ([89.116.164.85]) [177.11.169.201]:10136: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.37.150.181
country_id: 3469034
description:
2025-12-14 21:18:02 dovecot_plain authenticator failed for ([89.116.164.85]) [177.37.150.181]:15182: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.57.17
country_id: 3469034
description:
2025-12-14 21:18:14 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.57.17]:37058: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.64.64.155
country_id: 3865483
description:
2025-12-14 21:18:15 dovecot_plain authenticator failed for ([89.116.164.85]) [186.64.64.155]:43524: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.15.77
country_id: 6252001
description:
2025-12-14 21:18:39 dovecot_plain authenticator failed for ([89.116.164.85]) [98.97.15.77]:42282: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:19:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<KHECb+tFxp1S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.108.225.5
country_id: 3865483
description:
2025-12-14 21:18:27 dovecot_plain authenticator failed for host5.186-108-225.telecom.net.ar ([89.116.164.85]) [186.108.225.5]:40044: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:18:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<NViCbetFl6Ez0msW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.155.227.86
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.155.227.86 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.84.114.76
country_id: 1655842
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.84.114.76 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.116.250.163
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 41.116.250.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.130.238.23
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 177.130.238.23 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-14 21:20:08 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:48622: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.70.16
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 151.254.70.16 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.4.142.96
country_id: 798544
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.4.142.96 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.87.133
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.87.133 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-12-14 21:20:35 dovecot_login authenticator failed for ([125.19.93.105]) [182.95.50.154]:46564: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.5
country_id: 2635167
description:
Dec 14 21:21:24 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.5, lip=66.85.158.92, TLS, session=<l715d+tFJ6lX7LAF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.173.90.119
country_id: 298795
description:
2025-12-14 21:22:28 dovecot_plain authenticator failed for ([89.116.164.85]) [78.173.90.119]:27448: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.92.103.11
country_id: 719819
description:
2025-12-14 21:22:41 dovecot_plain authenticator failed for 4e5c670b.dsl.pool.telekom.hu ([89.116.164.85]) [78.92.103.11]:48130: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.79.185.34
country_id: 3469034
description:
2025-12-14 21:22:54 dovecot_plain authenticator failed for ([89.116.164.85]) [189.79.185.34]:54361: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 21:23:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<c9AHgOtF3tU+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 21:24:11 host2 sshd[2946590]: Disconnected from invalid user user 2.57.121.25 port 34042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 21:24:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<u1hjgetFYqI+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-14 21:24:50 dovecot_login authenticator failed for ([46.212.35.53]) [46.212.35.53]:38704: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-14 21:25:01 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:39286: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 21:25:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<8K8XhetF+oM+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-14 21:25:20 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:44934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-14 21:24:42 dovecot_login authenticator failed for (nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:47888: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-14 21:25:59 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:51232: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 21:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<vIbwh+tF2Mwv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-14 21:26:13 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (ulass) [78.68.37.25]:58162: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-12-14 21:26:18 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:45311: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 21:25:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<GVzkhutFbs4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-14 21:26:30 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:48080: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 21:27:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ndLci+tFtr8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 21:27:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rHMDjOtFBK8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 21:28:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<N7hMketFaK5o7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.41.201
country_id: 1819730
description:
Dec 14 21:29:01 host2 pure-ftpd[2950650]: (?@165.154.41.201) [INFO] New connection from 165.154.41.201


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 14 21:29:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.8, lip=66.85.158.91, session=<tj5Jk+tFOelV2YwI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 21:28:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<g1b2kOtFUrQrpAFm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 21:29:24 host2 sshd[2951009]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 14 21:29:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.8, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pqtElOtFOuhV2YwI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.49.47.148
country_id: 6252001
description:
[2025-12-14 21:31:21 +0530] info [cpaneld] 76.49.47.148 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 14 21:30:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<fNz+l+tFubJV2ZUJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:31:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<6SzFmetFjZYz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-12-14 21:31:13 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:44184: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 21:31:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<yo+BnOtFBOHIaZyl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.230.194.229
country_id: 3996063
description:
[2025-12-14 21:31:24 +0530] info [cpaneld] 148.230.194.229 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.87.31.78
country_id: 3865483
description:
[2025-12-14 21:31:26 +0530] info [whostmgrd] 149.87.31.78 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.105.182
country_id: 3469034
description:
[2025-12-14 21:31:27 +0530] info [cpaneld] 170.82.105.182 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.230.103.126
country_id: 3469034
description:
[2025-12-14 21:31:29 +0530] info [cpaneld] 45.230.103.126 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-14 21:32:19 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (guiteadmod) [96.230.65.90]:37728: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.58.238.98
country_id: 3439705
description:
[2025-12-14 21:31:23 +0530] info [cpaneld] 167.58.238.98 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.0.12.249
country_id: 3469034
description:
[2025-12-14 21:31:30 +0530] info [cpaneld] 200.0.12.249 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-14 21:31:45 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:34268: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.40
country_id: 6252001
description:
2025-12-14 21:32:04 dovecot_login authenticator failed for ([98.181.46.40]) [98.181.46.40]:41194: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-14 21:32:48 dovecot_login authenticator failed for wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:50059: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 21:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<D4BZoutFoqOYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 21:34:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<lvBopOtFaKM+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-14 21:34:15 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (axing) [90.0.156.128]:39518: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-14 21:35:11 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:41672: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.50
country_id: 1861060
description:
2025-12-14 21:34:45 dovecot_login authenticator failed for p388051-obmd01.tokyo.ocn.ne.jp [60.45.176.50]:54518: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-14 21:35:12 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:32960: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-12-14 21:35:44 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:33002: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 21:36:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<EcYOrutFbhxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 21:38:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PizdsutF2oAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-14 21:38:49 dovecot_login authenticator failed for ([45.130.148.217]) [45.130.148.217]:44586: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.36
country_id: 6252001
description:
2025-12-14 21:39:08 dovecot_login authenticator failed for ([98.181.46.36]) [98.181.46.36]:56159: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:39:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<Rl8It+tFttVS38qm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.203
country_id: 6252001
description:
Dec 14 21:38:39 host2 pure-ftpd[2959685]: (?@135.237.126.203) [INFO] New connection from 135.237.126.203


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 21:39:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<plBeuOtFOuPIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-14 21:39:23 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:53260: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 21:40:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=</bKUvOtFRLaYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 21:40:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<WZrnvOtFLNkrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.35
country_id: 6252001
description:
2025-12-14 21:41:26 dovecot_login authenticator failed for ([98.181.46.35]) [98.181.46.35]:60087: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.53.44
country_id: 1269750
description:
2025-12-14 21:41:52 dovecot_login authenticator failed for ([103.103.53.44]) [103.103.53.44]:35326: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.167.123.65
country_id: 390903
description:
2025-12-14 21:42:11 dovecot_plain authenticator failed for ppp079167123065.access.hol.gr ([89.116.164.85]) [79.167.123.65]:47872: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:42:22 host2 sshd[2963090]: Disconnected from invalid user game 103.171.85.42 port 37122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.196.36.128
country_id: 3469034
description:
2025-12-14 21:42:36 dovecot_login authenticator failed for ([89.116.164.85]) [200.196.36.128]:40117: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<BvdUw+tFppJDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.233.82.245
country_id: 3932488
description:
2025-12-14 21:42:50 dovecot_login authenticator failed for ([89.116.164.85]) [190.233.82.245]:53580: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:43:15 host2 sshd[2963712]: Disconnected from invalid user ardi 35.145.253.68 port 47208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:44:02 host2 sshd[2964197]: Disconnected from invalid user game 118.194.250.47 port 46000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 21:44:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<gdddyetFbNE+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 21:43:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<cIQvxutFVL4+PIdh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 21:44:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<hkNSyutFNLlDzRqg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.28.214.49
country_id: 6251999
description:
Dec 14 21:44:49 host2 sshd[2964755]: Disconnected from invalid user es 104.28.214.49 port 10785 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.54.181.6
country_id: 298795
description:
2025-12-14 21:45:10 dovecot_plain authenticator failed for ([89.116.164.85]) [94.54.181.6]:53202: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:45:37 host2 sshd[2965441]: Disconnected from invalid user userb 35.145.253.68 port 47995 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.6.57.210
country_id: 3932488
description:
2025-12-14 21:45:23 dovecot_plain authenticator failed for ([89.116.164.85]) [179.6.57.210]:42914: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 14 21:45:31 host2 sshd[2965363]: Disconnected from invalid user test123 167.71.204.253 port 38650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-14 21:45:55 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:36732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.224.208.180
country_id: 3865483
description:
2025-12-14 21:45:37 dovecot_plain authenticator failed for host180.190-224-208.telecom.net.ar ([89.116.164.85]) [190.224.208.180]:39948: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-12-14 21:45:41 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:53288: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.28.214.49
country_id: 6251999
description:
Dec 14 21:46:30 host2 sshd[2966255]: Disconnected from invalid user ardi 104.28.214.49 port 10807 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-14 21:47:01 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:38568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.145.253.68
country_id: 6252001
description:
Dec 14 21:46:46 host2 sshd[2966441]: Disconnected from invalid user sonar 35.145.253.68 port 47419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:46:50 host2 sshd[2966525]: Disconnected from invalid user avahi 103.171.85.42 port 59844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:46:57 host2 sshd[2966674]: Disconnected from invalid user baran 118.194.250.47 port 54432 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 21:47:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<QMGu0utFJJanR+bm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Dec 14 21:47:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ugyu0+tFKjVAPsU+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.44.117.75
country_id: 3865483
description:
2025-12-14 21:48:14 dovecot_plain authenticator failed for ([89.116.164.85]) [181.44.117.75]:41654: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:48:19 host2 sshd[2967801]: Disconnected from invalid user test123 118.194.250.47 port 42124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 14 21:47:27 host2 sshd[2967089]: Disconnected from invalid user admin 62.60.131.157 port 23841 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Dec 14 21:47:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cATI1OtFZGxAPsU+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-14 21:47:31 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:49092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Dec 14 21:47:46 host2 sshd[2967327]: Disconnected from invalid user avahi 101.36.107.103 port 52076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.163.250.116
country_id: 6252001
description:
2025-12-14 21:48:02 dovecot_plain authenticator failed for 99-163-250-116.lightspeed.iplsin.sbcglobal.net ([89.116.164.85]) [99.163.250.116]:58164: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Dec 14 21:49:02 host2 sshd[2968440]: Disconnected from invalid user facai 118.194.250.47 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 21:49:05 host2 sshd[2968521]: Disconnected from invalid user user 2.57.121.25 port 53285 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 21:50:08 host2 sshd[2969813]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.21.115
country_id: 241170
description:
Dec 14 21:50:11 host2 sshd[2969414]: Disconnected from invalid user avahi 154.222.21.115 port 56464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-14 21:50:36 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:59942: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 21:51:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<2MSP4etFGq8+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 21:51:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<p7dr4utFUJ5S38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-14 21:51:02 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:40716: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-14 21:50:26 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:51924: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-14 21:50:50 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:48040: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 21:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<4Vxt4etFiI8z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:51:02 host2 sshd[2971192]: Disconnected from invalid user ubuntu 103.171.85.42 port 53920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-14 21:52:19 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:46392: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 21:51:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<MHFw4utF1uE+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 14 21:51:27 host2 sshd[2971587]: Disconnected from invalid user baran 167.71.204.253 port 49148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-14 21:52:56 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.44.136.205
country_id: 1269750
description:
2025-12-14 21:56:48 dovecot_login authenticator failed for ([103.44.136.205]) [103.44.136.205]:49768: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2025-12-14 21:57:19 dovecot_login authenticator failed for ([49.124.148.2]) [49.124.148.2]:52732: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.42
country_id: 1643084
description:
Dec 14 21:56:27 host2 sshd[2980617]: Disconnected from invalid user ghost 103.171.85.42 port 36792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.150
country_id: 6252001
description:
2025-12-14 21:58:07 dovecot_login authenticator failed for ([70.174.167.150]) [70.174.167.150]:56415: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 21:58:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Z4RK++tFANo+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 21:58:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<47Is++tFMNA+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Dec 14 21:57:21 host2 sshd[2986202]: Disconnected from invalid user cluster 107.173.10.71 port 43996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-14 21:57:49 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:60812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 14 21:58:55 host2 sshd[2991061]: Disconnected from invalid user fts 134.209.225.104 port 36078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 21:59:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WgszAexFdJU+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 22:00:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<uxX/AexFFsk+PIdd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 14 21:59:26 host2 sshd[2991503]: Disconnected from invalid user administrator 134.209.225.104 port 36834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.71
country_id: 6252001
description:
Dec 14 21:59:36 host2 sshd[2991647]: Disconnected from invalid user x 107.173.10.71 port 44176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:01:45 host2 sshd[2993911]: Disconnected from invalid user thor 201.249.192.30 port 18214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:01:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rSwiCOxF6OYv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:02:31 host2 sshd[2994582]: Disconnected from invalid user kafka 201.249.192.30 port 19676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:03:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<h+LpDOxFtNov+wDY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Dec 14 22:03:14 host2 pure-ftpd[2995422]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:03:17 host2 sshd[2995418]: Disconnected from invalid user dev 201.249.192.30 port 10156 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-14 22:03:49 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (overous) [89.67.37.2]:34816: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-14 22:04:11 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:55544: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2025-12-14 22:04:49 dovecot_login authenticator failed for ([49.124.155.189]) [49.124.155.189]:57466: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:04:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=</e1OEuxFcpwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:05:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ht7AFuxFa5oz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FifHF+xFgAVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:06:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<T/ijGOxF8ovIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 14 22:07:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<ivXkGuxFiI+B4gum>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.47.243.18
country_id: 3469034
description:
2025-12-14 22:07:12 dovecot_plain authenticator failed for ([89.116.164.85]) [177.47.243.18]:28113: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-12-14 22:06:43 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:48226: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-12-14 22:06:45 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:39932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-12-14 22:06:55 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:50458: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.21.28
country_id: 6252001
description:
2025-12-14 22:06:59 dovecot_plain authenticator failed for c-71-193-21-28.hsd1.ca.comcast.net ([89.116.164.85]) [71.193.21.28]:47386: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-12-14 22:07:04 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:51368: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 22:08:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<RExFHuxFKog+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.169.219.56
country_id: 3469034
description:
2025-12-14 22:07:25 dovecot_plain authenticator failed for ([89.116.164.85]) [45.169.219.56]:31488: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 14 22:07:34 host2 sshd[2999912]: Disconnected from invalid user adnan 201.249.192.30 port 34949 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:07:45 host2 sshd[3000068]: Disconnected from invalid user chrome 172.191.239.155 port 57978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 22:09:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<+9F7JOxFopErpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:10:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<bl4kJuxF6NKYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 22:10:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<VsjMJ+xFktA+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.230
country_id: 6252001
description:
Dec 14 22:10:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.132.230, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6woRKOxFbsaTuYTm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-14 22:10:53 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:57690: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-14 22:11:05 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:33163: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:11:10 host2 sshd[3003975]: Disconnected from invalid user usuario2 172.191.239.155 port 39166 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec 14 22:10:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, session=<J3YBJ+xFBAm4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Dec 14 22:10:34 host2 sshd[3003273]: Disconnected from invalid user admin2 172.191.239.155 port 56668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.192.189
country_id: 99237
description:
2025-12-14 22:13:16 dovecot_login authenticator failed for ([89.116.164.85]) [185.56.192.189]:27326: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:14:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<q1CzNexFvrNo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-14 22:15:29 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (brefy) [75.74.211.27]:37234: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:15:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<I90LOexFLNpS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-14 22:15:42 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:40832: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.69.147
country_id: 3374766
description:
2025-12-14 22:15:53 dovecot_login authenticator failed for ([154.203.69.147]) [154.203.69.147]:35489: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-14 22:15:53 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:45214: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:16:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<5AcGPOxFhJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-14 22:16:30 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:36380: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-14 22:16:37 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:57670: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
country_id: 294640
description:
2025-12-14 22:16:50 dovecot_login authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:53478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-14 22:17:07 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:55280: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:17:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<KbzkPuxFwJvIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:17:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Gl7hQOxFzteYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 14 22:18:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<9ndYQ+xFjsvBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:19:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<Zj6ORuxFlttDzRqg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.230
country_id: 6252001
description:
Dec 14 22:19:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.230, lip=66.85.158.92, TLS, session=<8a9vR+xFdPqTuYTm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 14 22:21:07 host2 pure-ftpd[3017667]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-14 22:21:13 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:59150: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:21:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<cmuRTexFusxDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-14 22:21:54 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:49312: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-12-14 22:22:12 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:47918: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec 14 22:23:32 host2 pure-ftpd[3020932]: (?@194.165.16.165) [INFO] New connection from 194.165.16.165


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-14 22:24:58 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (janthuk) [73.224.171.101]:48896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 14 22:27:02 host2 sshd[3026068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.232.58.205
country_id: 3996063
description:
2025-12-14 22:26:15 dovecot_plain authenticator failed for ([89.116.164.85]) [187.232.58.205]:54438: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.191.46.247
country_id: 3625428
description:
2025-12-14 22:26:34 dovecot_plain authenticator failed for ([89.116.164.85]) [38.191.46.247]:57262: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:27:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<7n43ZexFuKFS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GNXoZexFq6Uz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.38
country_id: 3175395
description:
Dec 14 22:30:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.38, lip=66.85.158.91, TLS, session=<7RFVbOxFlc+5xQkm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.97
country_id: 3175395
description:
Dec 14 22:29:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=217.26.179.97, lip=66.85.158.91, TLS, session=<zAQ6a+xFhMvZGrNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-12-14 22:32:00 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:56786: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-14 22:31:42 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (moreval) [67.173.58.47]:53510: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-14 22:31:48 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:50546: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 14 22:33:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<xt7Od+xFPIw+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 14 22:33:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<mp28euxF4Kc+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.41
country_id: 6252001
description:
2025-12-14 22:35:38 dovecot_login authenticator failed for ([98.181.46.41]) [98.181.46.41]:34203: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-14 22:36:28 dovecot_plain authenticator failed for (caffies) [199.192.123.12]:49816: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-14 22:36:31 dovecot_login authenticator failed for (cm-84.213.189.159.get.no) [84.213.189.159]:53515: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.73
country_id: 6252001
description:
Dec 14 22:37:17 host2 pure-ftpd[3042563]: (?@198.235.24.73) [INFO] New connection from 198.235.24.73


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 14 22:37:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GZoqh+xFSO0+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 22:37:35 dovecot_plain authenticator failed for (cullin) [5.31.23.133]:54232: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-14 22:37:50 dovecot_plain authenticator failed for (marge) [105.114.21.51]:40480: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-12-14 22:37:58 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:53104: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-14 22:39:10 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:33512: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:39:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<93mEjexF1JYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 14 22:39:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<CL1oj+xFboY+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-14 22:40:55 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:41345: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2025-12-14 22:41:05 dovecot_login authenticator failed for ([49.124.154.172]) [49.124.154.172]:38170: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 22:40:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<RmBAkuxFMIov+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-14 22:40:44 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:56322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-12-14 22:41:20 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:57073: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-14 22:41:32 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:59756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-14 22:42:00 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:54158: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.211.254
country_id: 3865483
description:
2025-12-14 22:42:08 dovecot_plain authenticator failed for ([89.116.164.85]) [186.13.211.254]:51667: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-14 22:42:08 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:32892: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.217.252
country_id: 3865483
description:
2025-12-14 22:42:41 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.217.252]:56566: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 22:43:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<bwhhm+xF+LAz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:43:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1cZzm+xFSKcvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.13.211.254
country_id: 3865483
description:
2025-12-14 22:42:17 dovecot_login authenticator failed for ([89.116.164.85]) [186.13.211.254]:51667: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.208.245.210
country_id: 3469034
description:
2025-12-14 22:42:20 dovecot_plain authenticator failed for ([89.116.164.85]) [143.208.245.210]:50207: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2025-12-14 22:42:20 dovecot_login authenticator failed for ([49.124.159.179]) [49.124.159.179]:35192: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-14 22:42:29 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:32830: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:44:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<bCHnnuxFaCBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-14 22:47:06 dovecot_login authenticator failed for ([182.95.20.13]) [122.187.41.18]:41986: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 14 22:47:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<9MoIquxFUrE+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:47:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<nZDvquxFDKLIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.173.59.73
country_id: 1605651
description:
2025-12-14 22:47:31 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [118.173.59.73]:34533: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.23.133
country_id: 290557
description:
2025-12-14 22:47:45 dovecot_plain authenticator failed for (progenter) [5.31.23.133]:53944: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-14 22:47:50 dovecot_plain authenticator failed for (psupswism) [65.20.143.159]:43926: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:47:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<fPi5quxFINiYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-14 22:48:30 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:46802: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-14 22:48:51 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:58918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 14 22:52:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<ZlORu+xFxJg+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-14 22:51:31 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60190: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 22:52:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<89LMvuxFQqGnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 22:52:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ORgavOxFPC5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 22:52:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<12aGvOxFQOBS38qm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Dec 14 22:53:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<rc/Uv+xFxn5ChJmA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 22:54:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<0SDixOxF8sYvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 22:54:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<kG9PxexFeLaYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 22:54:20 host2 sshd[3067992]: Disconnected from invalid user user 2.57.121.25 port 28793 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:56:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<OvioyexFfrhDzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-12-14 22:56:53 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:57230: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 22:57:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<40UA0OxFRNjIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-14 22:57:57 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:35898: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 22:57:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<Ob3G0OxFVt5DzRqg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-14 22:57:32 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:55871: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 14 22:57:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<dsf2z+xF5o4+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Dec 14 22:57:46 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.92, session=<VqAY0OxFAI6s7OTe>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.195.150
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.42.195.150 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-14 22:58:34 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:59874: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 14 23:00:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<t1oX2exFnMs+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 14 23:00:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<kkm82exFOKw+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-12-14 23:01:47 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:37811: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-14 23:02:07 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:50009: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.10.94.237
country_id: 3865483
description:
2025-12-14 23:02:25 dovecot_plain authenticator failed for host237.181-10-94.telecom.net.ar ([89.116.164.85]) [181.10.94.237]:35757: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.155.209.112
country_id: 2264397
description:
2025-12-14 23:02:39 dovecot_plain authenticator failed for a89-155-209-112.cpe.netcabo.pt ([89.116.164.85]) [89.155.209.112]:45888: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.197.89.89
country_id: 6252001
description:
2025-12-14 23:02:50 dovecot_plain authenticator failed for 108-197-89-89.lightspeed.mdldtx.sbcglobal.net ([89.116.164.85]) [108.197.89.89]:34452: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 23:03:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@mathsmotorcysle.xyz>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<vEJR5exF4I8rpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-14 23:04:11 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64575: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-14 23:04:28 dovecot_login authenticator failed for ([180.94.75.42]) [180.94.75.42]:46613: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Dec 14 23:04:53 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, session=<Ig2Z6exF6uOsaAsu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 23:05:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<YmPi6exFPKlS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 23:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<KNMw6+xFTOOnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:05:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Fw3h6+xFSb8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 23:06:05 dovecot_plain authenticator failed for (bered) [12.150.243.22]:19752: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.56.134
country_id: 1269750
description:
2025-12-14 23:06:36 dovecot_login authenticator failed for ([182.95.24.117]) [182.95.56.134]:51014: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-14 23:06:46 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:59150: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-14 23:06:58 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:35851: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.130.79
country_id: 2077456
description:
2025-12-14 23:07:08 dovecot_login authenticator failed for (61-69-130-79.static.tpgi.com.au) [61.69.130.79]:36882: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 14 23:07:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<xWGj8exFgqQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.52.50.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 174.52.50.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.53.231.221
country_id: 102358
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 188.53.231.221 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.136.26.28
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 110.136.26.28 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.64.28.82
country_id: 2017370
description:
2025-12-14 23:08:05 dovecot_login authenticator failed for ([80.64.28.82]) [80.64.28.82]:33143: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.239.91.169
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.239.91.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.232.241.13
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.232.241.13 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.126.119
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 94.203.126.119 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.99.220.117
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 92.99.220.117 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-14 23:08:50 dovecot_login authenticator failed for (54-170-97-62.cust.smartcall.no) [62.97.170.54]:45416: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.236.122.222
country_id: 6252001
description:
Dec 14 23:09:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 21 secs): user=<>, rip=18.236.122.222, lip=66.85.158.92, TLS: Connection closed, session=<gFa++OxFMLYS7Hre>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 14 23:09:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<nis4+exFdJk+PIdd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Dec 14 23:11:09 host2 pure-ftpd[3092475]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 14 23:11:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<bFhOAu1FBNQ+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-14 23:12:51 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:59174: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-14 23:13:05 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:55612: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 14 23:13:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Oz28CO1FvKY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-14 23:13:39 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:49878: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.147.94.97
country_id: 6290252
description:
2025-12-14 23:14:02 dovecot_plain authenticator failed for ([89.116.164.85]) [89.147.94.97]:47690: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-14 23:13:25 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:55380: 535 Incorrect authentication data (set_id=accounts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.223.101.104
country_id: 298795
description:
2025-12-14 23:14:28 dovecot_plain authenticator failed for ([89.116.164.85]) [31.223.101.104]:44973: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.110.12.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.110.12.79 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.81.184.155
country_id: 3865483
description:
2025-12-14 23:15:11 dovecot_plain authenticator failed for ([89.116.164.85]) [191.81.184.155]:38866: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.19.141.210
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.19.141.210 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.225.55.182
country_id: 6252001
description:
2025-12-14 23:14:14 dovecot_plain authenticator failed for 182.sub-97-225-55.myvzw.com ([89.116.164.85]) [97.225.55.182]:33578: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.174.52.182
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.174.52.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.36
country_id: 3469034
description:
2025-12-14 23:15:44 dovecot_plain authenticator failed for 189-89-12-36.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.36]:36912: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.5.82.183
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 191.5.82.183 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.183.106
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.183.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.81.0.133
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.81.0.133 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.255.217
country_id: 3469034
description:
2025-12-14 23:15:27 dovecot_plain authenticator failed for ([89.116.164.85]) [45.191.255.217]:53795: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.174.109.206
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.174.109.206 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.81.184.155
country_id: 3865483
description:
2025-12-14 23:15:18 dovecot_login authenticator failed for ([89.116.164.85]) [191.81.184.155]:38866: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 14 23:16:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<eJObE+1FLpdChJl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.6.6.179
country_id: 3865483
description:
2025-12-14 23:16:53 dovecot_plain authenticator failed for ([89.116.164.85]) [45.6.6.179]:52214: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:17:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FCP0FO1FRrUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.244.153.112
country_id: 99237
description:
2025-12-14 23:16:23 dovecot_plain authenticator failed for ([89.116.164.85]) [185.244.153.112]:38141: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.44.64
country_id: 3865483
description:
2025-12-14 23:16:37 dovecot_plain authenticator failed for ([89.116.164.85]) [45.181.44.64]:44117: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:18:19 host2 sshd[3102066]: Disconnected from invalid user fernando 43.135.159.152 port 49756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 14 23:18:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<7fDXGe1FwKgv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.1.63
country_id: 1168579
description:
2025-12-14 23:18:51 dovecot_plain authenticator failed for ([89.116.164.85]) [154.192.1.63]:58454: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-14 23:18:56 dovecot_plain authenticator failed for (podly) [12.150.243.22]:30649: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.167.22.89
country_id: 102358
description:
2025-12-14 23:19:06 dovecot_plain authenticator failed for ([89.116.164.85]) [31.167.22.89]:50298: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.167.22.89
country_id: 102358
description:
2025-12-14 23:19:13 dovecot_login authenticator failed for ([89.116.164.85]) [31.167.22.89]:50298: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.247.120.232
country_id: 3686110
description:
2025-12-14 23:19:24 dovecot_plain authenticator failed for ([89.116.164.85]) [77.247.120.232]:44442: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 14 23:19:37 host2 sshd[3103819]: Disconnected from invalid user user 2.57.121.25 port 51702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-14 23:20:09 dovecot_plain authenticator failed for (poringoisa) [102.53.15.56]:49582: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:20:45 host2 sshd[3105495]: Disconnected from invalid user weblogic 43.135.159.152 port 55214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.210.107.22
country_id: 3017382
description:
Dec 14 23:20:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<sZrWIu1FO84z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.245.123.158
country_id: 3469034
description:
2025-12-14 23:21:29 dovecot_plain authenticator failed for ([89.116.164.85]) [170.245.123.158]:49890: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.14.20.239
country_id: 798549
description:
Dec 14 23:21:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.14.20.239, lip=66.85.158.91, TLS, session=<jJ3rJO1FvuIfDhTv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-12-14 23:21:15 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:55902: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.141
country_id: 99237
description:
Dec 14 23:21:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=65.20.213.141, lip=66.85.158.91, TLS, session=<28qpI+1FcsVBFNWN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 23:21:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<tHk8Ju1FRAgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 23:21:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<LyugJu1FhuVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.109.237
country_id: 3865483
description:
2025-12-14 23:22:05 dovecot_plain authenticator failed for ([89.116.164.85]) [179.38.109.237]:35150: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-14 23:22:08 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:39032: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2025-12-14 23:21:42 dovecot_login authenticator failed for (nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:56702: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.53.230.195
country_id: 6252001
description:
2025-12-14 23:21:41 dovecot_plain authenticator failed for 75-53-230-195.lightspeed.hstntx.sbcglobal.net ([89.116.164.85]) [75.53.230.195]:38622: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 14 23:21:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Nzn1Je1FdOQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.38.109.237
country_id: 3865483
description:
2025-12-14 23:22:16 dovecot_login authenticator failed for ([89.116.164.85]) [179.38.109.237]:35150: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-14 23:22:25 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:32784: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.159.152
country_id: 6252001
description:
Dec 14 23:22:35 host2 sshd[3107974]: Disconnected from invalid user ansible 43.135.159.152 port 52162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-14 23:22:42 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:35433: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-14 23:23:01 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:50174: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-14 23:23:45 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (super) [24.15.216.41]:38856: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 23:24:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<uF62MO1FhuSYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 14 23:24:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<i5DhMO1FtOQ+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-14 23:25:41 dovecot_login authenticator failed for (nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:52822: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-14 23:25:59 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:45690: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.144.90.38
country_id: 6252001
description:
Dec 14 23:26:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=18.144.90.38, lip=66.85.158.91, TLS: Connection closed, session=<94i4Nu1FwJASkFom>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-14 23:26:44 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:42440: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-14 23:26:44 dovecot_plain authenticator failed for (preing) [88.207.210.23]:59711: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-14 23:26:49 dovecot_plain authenticator failed for (hurist) [109.226.27.227]:53389: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.204.9.239
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.204.9.239 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.37.130.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.37.130.203 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.130.134.68
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.130.134.68 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-14 23:28:10 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:43645: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.59.210.227
country_id: 1522867
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.59.210.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.63.33
country_id: 6252001
description:
2025-12-14 23:27:20 dovecot_login authenticator failed for ([98.181.63.33]) [98.181.63.33]:35078: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.239.67.117
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 201.239.67.117 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.32.241.229
country_id: 3686110
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 181.32.241.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.81.217.39
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 170.81.217.39 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-14 23:28:24 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:34938: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-14 23:28:43 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:41200: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Dec 14 23:28:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<mTr0Pu1FzozIaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-14 23:29:10 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:40472: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-14 23:29:30 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:51706: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 14 23:30:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<h1lqQ+1FmOVS38qm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 14 23:30:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<olygRO1FWmdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-14 23:31:29 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:58620: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.172.196.177
country_id: 6252001
description:
Dec 14 23:31:38 host2 sshd[3120380]: Disconnected from invalid user vpsuser 172.172.196.177 port 52730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-12-14 23:31:42 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:41738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-14 23:31:44 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:51276: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.224.93.98
country_id: 3865483
description:
2025-12-14 23:32:53 dovecot_plain authenticator failed for host98.190-224-93.telecom.net.ar ([89.116.164.85]) [190.224.93.98]:46098: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.93.156
country_id: 3469034
description:
2025-12-14 23:33:06 dovecot_plain authenticator failed for ([89.116.164.85]) [186.65.93.156]:45944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 14 23:32:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KcN6S+1F2IOYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2025-12-14 23:32:27 dovecot_login authenticator failed for ([128.185.194.190]) [128.185.194.190]:41006: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-14 23:32:44 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:46234: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-14 23:34:09 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:38388: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.65.93.156
country_id: 3469034
description:
2025-12-14 23:33:13 dovecot_login authenticator failed for ([89.116.164.85]) [186.65.93.156]:45944: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.1.161.191
country_id: 3469034
description:
2025-12-14 23:33:20 dovecot_plain authenticator failed for 177-1-161-191.user3p.v-tal.net.br ([89.116.164.85]) [177.1.161.191]:55576: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.205.26.160
country_id: 6252001
description:
Dec 14 23:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=67.205.26.160, lip=66.85.158.91, session=<qrGhUO1F7uhDzRqg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec 14 23:33:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<pA08T+1FxOCnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 14 23:33:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aQozUO1FsOUvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2025-12-14 23:33:44 dovecot_login authenticator failed for (187-50-226-182.customer.tdatabrasil.net.br) [187.50.226.182]:41408: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-14 23:33:15 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:35698: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec 14 23:33:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<59L8Tu1FDosrpAFm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-12-14 23:33:18 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:45597: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


