# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 10:59:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<F3764/ZFKMUIgeYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 15 10:59:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<jdPC5fZFtq4+PIdc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.161.108
country_id: 6252001
description:
Dec 15 11:00:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.202.161.108, lip=66.85.158.91, TLS: Connection closed, session=<UwMH5/ZFAKU2yqFs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 11:00:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<H6JU6vZFwquLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-15 11:01:03 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:56541: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-15 11:00:14 dovecot_plain authenticator failed for (ablatta) [154.146.240.123]:58534: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-15 11:00:49 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:34238: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-15 11:00:50 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:59833: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-12-15 11:01:44 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:38491: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 11:02:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<+HBu7vZFruw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:01:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<uMLt6/ZFfo4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-15 11:02:19 dovecot_plain authenticator failed for (latmers) [38.248.111.238]:57117: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.11.166
country_id: 1819730
description:
Dec 15 11:02:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=129.226.11.166, lip=66.85.158.91, session=<L6M57/ZF8oOB4gum>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 11:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<48x28PZFNPMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 11:04:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<b01J9fZFnrKG0Wp/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.189
country_id: 1694008
description:
2025-12-15 11:03:14 dovecot_login authenticator failed for (ADMIN) [188.214.125.189]:16326: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 11:03:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<SDaH8vZFesmYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 11:03:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yRjo8vZFlOg+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 11:03:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<bJ/N8vZFRrSPbvgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 11:03:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ohGw8/ZFJMY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:03:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<4+hn9PZFXK4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 11:04:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<u4g89/ZFAtkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 11:04:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<D6CL+PZFySJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 11:05:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<+/Y2+fZFpKkuZXpm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 11:06:02 host2 sshd[3926720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.76
country_id: 660013
description:
2025-12-15 11:06:31 dovecot_login authenticator failed for (ADMIN) [188.126.89.76]:57407: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-15 11:06:42 dovecot_plain authenticator failed for (boatae) [94.201.22.158]:45525: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 11:07:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<ZnI0AvdFWKkv+44t>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.241
country_id: 6252001
description:
Dec 15 11:10:17 host2 pure-ftpd[3930285]: (?@205.210.31.241) [INFO] New connection from 205.210.31.241


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 11:10:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<AZjeC/dFbt8ro2np>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-12-15 11:11:25 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:51616: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 11:11:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<nhRUEPdFZoqPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-15 11:11:42 dovecot_login authenticator failed for ([128.185.247.210]) [182.79.89.14]:55370: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 11:11:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<9QiiEfdF9jUvWbHj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.153.41.210
country_id: 6252001
description:
Dec 15 11:14:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=54.153.41.210, lip=66.85.158.92, TLS: Connection closed, session=<QYR4G/dFRN82mSnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 11:15:59 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:35082: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 11:16:06 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:53536: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-15 11:18:55 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (sphalds) [73.137.7.97]:51378: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 11:20:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<NzXuMPdFOoaPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 11:22:14 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:34036: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.203
country_id: 3077311
description:
2025-12-15 11:22:22 dovecot_login authenticator failed for (ADMIN) [212.102.39.203]:5463: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 11:23:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<spkpPPdFxJM+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-15 11:24:00 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (mantitrius) [73.196.144.25]:34708: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-15 11:23:16 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:57348: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-15 11:23:29 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:38192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 11:24:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<3evlPfdFPNBnsX0d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-15 11:24:25 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 11:25:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<F21vQfdFoqqnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.50
country_id: 660013
description:
2025-12-15 11:27:55 dovecot_login authenticator failed for (ADMIN) [188.126.89.50]:54917: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 11:27:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<o/W9SPdFQsg+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.93
country_id: 130758
description:
Dec 15 11:27:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.93, lip=66.85.158.91, session=<q70MSvdFrsA+PIdd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 11:29:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<dataesitelk@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<p/epUPdFCMgv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-15 11:29:59 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:33513: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-15 11:30:34 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:53437: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 11:31:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FYzaVvdFoOcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 11:31:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<NRxUWPdFrI0+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 11:31:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<2qiZWPdFKrmhI2jD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 11:32:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<N0OcWvdFvII+PIdb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 11:32:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<4ga8W/dFnjSuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-15 11:33:59 dovecot_plain authenticator failed for (tacaling) [102.53.15.18]:58725: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 11:34:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<qyjHYfdFCOs+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 11:34:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<tdHmYPdFEscIiWqS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-15 11:36:36 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (lookayte) [98.204.134.124]:40754: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 11:38:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<L7ntbvdFaOY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 11:38:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<X5hQcPdFONg+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 11:39:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<0rkVdfdF/qU+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 11:41:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<ILF1evdF5L5S38qm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 11:43:40 host2 sshd[3958695]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 11:43:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<kLi2gfdFsLI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-15 11:43:33 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (amnotes) [73.197.194.98]:39454: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 11:43:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<+dERgfdFvounrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 11:43:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<laZBgfdFquqWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-15 11:45:06 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (undledrosm) [37.150.8.174]:45698: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-15 11:44:14 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:54287: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:44:29 host2 sshd[3959417]: Disconnected from invalid user user 69.74.29.21 port 62101 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-15 11:44:43 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:54341: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 11:44:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<lnTEh/dF5uY+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:45:29 host2 sshd[3960580]: Disconnected from invalid user email 199.195.248.191 port 48602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 15 11:45:55 host2 sshd[3960851]: Disconnected from invalid user weblogic 202.157.177.33 port 49036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 11:45:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (praggly) [87.103.126.54]:41773: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 11:46:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<qSQRjvdFOtk+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 11:46:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<nx2XjvdFuuunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 11:46:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9OwIjPdFUIU+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.66
country_id: 2077456
description:
2025-12-15 11:46:17 dovecot_login authenticator failed for (ADMIN) [154.16.81.66]:24280: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.22
country_id: 2562770
description:
2025-12-15 11:46:23 dovecot_login authenticator failed for (ADMIN) [176.125.230.22]:32916: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:47:07 host2 sshd[3961970]: Disconnected from invalid user auditor 69.74.29.21 port 34972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:47:22 host2 sshd[3962162]: Disconnected from invalid user download 199.195.248.191 port 58306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:48:05 host2 sshd[3962761]: Disconnected from invalid user wanda 177.44.220.67 port 55642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:48:34 host2 sshd[3963537]: Disconnected from invalid user git2 199.195.248.191 port 55002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 11:48:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<zkETlfdFppo+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:48:49 host2 sshd[3963756]: Disconnected from invalid user user1 93.71.118.99 port 39314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:48:54 host2 sshd[3963806]: Disconnected from invalid user student2 68.183.236.1 port 47480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 11:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<E2lxlvdFqMA+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:48:32 host2 sshd[3963486]: Disconnected from invalid user rob 69.74.29.21 port 54048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 15 11:49:08 host2 sshd[3963986]: Disconnected from invalid user mike 199.195.248.191 port 39234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Dec 15 11:49:14 host2 sshd[3964083]: Disconnected from invalid user player 69.74.29.21 port 48636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:49:53 host2 sshd[3964590]: Disconnected from invalid user admin 68.183.236.1 port 57908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 15 11:49:58 host2 sshd[3964640]: Disconnected from invalid user vpnuser 202.157.177.33 port 33558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 11:50:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<bMEZnPdFCpikXF7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 15 11:50:40 host2 sshd[3965407]: Disconnected from invalid user worker 68.183.236.1 port 38366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:50:16 host2 sshd[3965081]: Disconnected from invalid user royal 177.44.220.67 port 32830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 11:50:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6q42m/dFRL8+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:51:50 host2 sshd[3966582]: Disconnected from invalid user worker 181.188.176.247 port 52464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:52:43 host2 sshd[3967367]: Disconnected from invalid user jenkins 101.36.126.138 port 46224 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.212
country_id: 6252001
description:
Dec 15 11:52:19 host2 pure-ftpd[3967031]: (?@198.235.24.212) [INFO] New connection from 198.235.24.212


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:53:09 host2 sshd[3967823]: Disconnected from invalid user git2 177.44.220.67 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:53:21 host2 sshd[3968101]: Disconnected from invalid user weblogic 101.36.126.138 port 42170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:53:38 host2 sshd[3968494]: Disconnected from invalid user laravel 93.71.118.99 port 44952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:53:52 host2 sshd[3968677]: Disconnected from invalid user edubook 181.188.176.247 port 44732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:54:32 host2 sshd[3969563]: Disconnected from invalid user admin 181.188.176.247 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:54:40 host2 sshd[3969720]: Disconnected from invalid user test 101.36.126.138 port 33842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-15 11:54:44 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:47676: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Dec 15 11:55:21 host2 sshd[3970579]: Disconnected from invalid user guest 177.44.220.67 port 57154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.126.138
country_id: 1819730
description:
Dec 15 11:55:53 host2 sshd[3970996]: Disconnected from invalid user zhangc 101.36.126.138 port 51304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.247
country_id: 3923057
description:
Dec 15 11:55:56 host2 sshd[3971046]: Disconnected from invalid user tom 181.188.176.247 port 54338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 11:56:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oGFfsvdFDraLO0qU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:56:19 host2 sshd[3971583]: Disconnected from invalid user ftpuser 98.159.109.235 port 47022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-15 11:56:25 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47173: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-12-15 11:56:43 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:33222: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 15 11:57:17 host2 sshd[3972336]: Disconnected from invalid user login 93.71.118.99 port 38668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:57:29 host2 sshd[3972481]: Disconnected from invalid user zhangm 98.159.109.235 port 34246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 11:57:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<Rm0ptvdFGMO8pkxr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 11:57:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<gtpHtvdFuq+B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 11:58:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<niOHuPdFVN6l6LP6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.159.109.235
country_id: 6252001
description:
Dec 15 11:58:41 host2 sshd[3973412]: Disconnected from invalid user user4 98.159.109.235 port 38360 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 15 11:59:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<l9S/uvdFtuc+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 11:59:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<U+ixu/dFIthnhdZ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 11:59:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<dRo7vPdFqqc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-15 11:59:48 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:55206: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-15 12:00:13 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:35747: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 12:00:19 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:42890: 535 Incorrect authentication data (set_id=no-reply@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.21
country_id: 6252001
description:
2025-12-15 12:01:28 dovecot_login authenticator failed for (ADMIN) [95.181.238.21]:56796: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 12:01:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<lteHw/dFAOg+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec 15 12:02:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=</2QiyPdF5rpnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:05:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sobaherbalcom@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<QDrWz/dFvmAvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.226.123.65
country_id: 1522867
description:
Dec 15 12:05:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=46.226.123.65, lip=66.85.158.91, session=<enyr0PdFZusu4ntB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-15 12:06:50 dovecot_plain authenticator failed for (biumismena) [187.161.198.68]:57480: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.99
country_id: 3469034
description:
Dec 15 12:07:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.154.227.99, lip=66.85.158.91, TLS, session=<XMzc1fdFz+SxmuNj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.13
country_id: 3469034
description:
Dec 15 12:07:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.71.13, lip=66.85.158.91, TLS, session=<upIO1/dFMrWxLEcN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 12:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<qdVm2fdF6K8+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 12:09:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Iosl4fdFQp4+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 12:10:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EKXn4fdF4IA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:10:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<essenceceylonteacom@essenceceylontea.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<e+By4/dF1AsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:10:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<QR8N5PdFVOM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 12:10:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=</5N/5PdF2KM+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 12:11:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<YAvl5PdFTuc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-15 12:11:07 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (roffert) [73.168.136.150]:48568: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.44
country_id: 130758
description:
2025-12-15 12:12:42 dovecot_plain authenticator failed for (localhost) [62.60.135.44]:38684: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-15 12:12:46 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:58304: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.67.42.25
country_id: 6252001
description:
Dec 15 12:12:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=54.67.42.25, lip=66.85.158.92, TLS: Connection closed, session=<AXgk6/dF0p02QyoZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 15 12:12:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<g3pd6vdFXBto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-15 12:14:22 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:52150: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2025-12-15 12:14:53 dovecot_login authenticator failed for ([149.54.33.130]) [149.54.33.130]:53007: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.179
country_id: 2186224
description:
2025-12-15 12:14:18 dovecot_login authenticator failed for (ADMIN) [179.61.240.179]:63707: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-15 12:15:42 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (nonatheds) [98.203.34.136]:39494: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.25
country_id: 2750405
description:
2025-12-15 12:17:19 dovecot_login authenticator failed for (ADMIN) [158.173.3.25]:52267: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.247.54
country_id: 1605651
description:
Dec 15 12:17:49 host2 pure-ftpd[3993936]: (?@152.32.247.54) [INFO] New connection from 152.32.247.54


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 15 12:17:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=</6aI/fdFKtYuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-15 12:18:00 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:41708: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-15 12:18:20 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:46112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 15 12:18:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ZhjlAPhFeI6YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-15 12:19:04 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:52965: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 12:19:47 host2 sshd[3995760]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Dec 15 12:19:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<uoXoAvhFlMQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 12:19:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@seyawin.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<UtqLAvhFaJaLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.39.87.7
country_id: 6251999
description:
2025-12-15 12:19:24 dovecot_login authenticator failed for d72-39-87-7.home1.cgocable.net [72.39.87.7]:48040: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Dec 15 12:20:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<w3szCPhFCjwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec 15 12:20:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<tYDjBvhFBtCPbvgo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 15 12:20:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.8, lip=66.85.158.92, session=<ccJ8B/hFsdFV2YwI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.129.230.30
country_id: 1814991
description:
Dec 15 12:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=8.129.230.30, lip=66.85.158.91, session=<1qULCfhFAJwIgeYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-15 12:21:14 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:50048: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.121
country_id: 3865483
description:
Dec 15 12:21:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.251.121, lip=66.85.158.91, TLS, session=<A3QkCfhFY+uzAPt5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.9
country_id: 953987
description:
Dec 15 12:21:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=41.79.19.9, lip=66.85.158.91, TLS, session=<jAZxCvhFLY4pTxMJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.209.106.127
country_id: 1880251
description:
Dec 15 12:22:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=134.209.106.127, lip=66.85.158.91, session=<ErUCD/hFJqyG0Wp/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Dec 15 12:23:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<bAXKD/hF7s0v+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 15 12:23:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<uDXFEPhFlzdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 12:23:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<PHisEfhFVoU+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.163.105.233
country_id: 1880251
description:
Dec 15 12:25:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=43.163.105.233, lip=66.85.158.91, session=<Q9w+GfhFZoIro2np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 12:25:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<kiriaswanucom@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<aujHGfhFqp4vWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-15 12:26:09 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:37038: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.29
country_id: 6252001
description:
2025-12-15 12:26:19 dovecot_login authenticator failed for ([98.181.46.29]) [98.181.46.29]:51391: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 89.248.167.131
country_id: 2750405
description:
Dec 15 12:28:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=89.248.167.131, lip=66.85.158.91, session=<m/A3I/hFcuZZ+KeD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 12:29:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<H8q+JvhFMuKPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 12:29:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<aOR5KPhFmJQ+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 12:31:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<h+67LfhFuLQ+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.22
country_id: 2562770
description:
2025-12-15 12:31:17 dovecot_login authenticator failed for (ADMIN) [176.125.230.22]:60563: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.41
country_id: 2264397
description:
2025-12-15 12:34:10 dovecot_login authenticator failed for (ADMIN) [146.70.59.41]:37417: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 12:34:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UmyzOPhFcr8+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.12
country_id: 6252001
description:
2025-12-15 12:37:27 dovecot_login authenticator failed for (172-125-13-12.lightspeed.rcsntx.sbcglobal.net) [172.125.13.12]:44837: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-12-15 12:37:37 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:50093: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec 15 12:38:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<PuJpR/hFMKiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.177.125.29
country_id: 1210997
description:
Dec 15 12:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=103.177.125.29, lip=66.85.158.91, session=<STe5TvhFFOFnsX0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 12:41:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<EbAHUvhFgo2nrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-15 12:42:36 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (obbla) [78.68.37.25]:56767: 535 Incorrect authentication data (set_id=hr@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-15 12:42:46 dovecot_plain authenticator failed for (karampor) [12.150.243.22]:13766: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-15 12:45:25 dovecot_plain authenticator failed for (pingorks) [91.73.188.251]:51088: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 15 12:45:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qav5X/hFasAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 161.35.104.195
country_id: 6252001
description:
Dec 15 12:45:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=161.35.104.195, lip=66.85.158.91, session=<IjdXYPhFoImhI2jD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-15 12:45:41 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:37215: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-15 12:46:08 dovecot_login authenticator failed for (nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:41456: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.5
country_id: 1227603
description:
2025-12-15 12:47:22 dovecot_login authenticator failed for (ADMIN) [95.181.239.5]:37469: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Dec 15 12:47:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<hNT6ZvhFwNIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Dec 15 12:48:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<wfkHavhFrrGuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-15 12:48:28 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:50233: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-15 12:48:45 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:36286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-15 12:49:35 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (hisors) [24.23.125.83]:34534: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-15 12:49:37 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (hoctrate) [98.193.112.85]:42768: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.85.209.7
country_id: 798544
description:
Dec 15 12:50:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.85.209.7, lip=66.85.158.91, TLS, session=<Li6icvhFssQtVdEH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:50:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<izvBcfhFFLU+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.32.111.202
country_id: 3865483
description:
Dec 15 12:51:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=200.32.111.202, lip=66.85.158.91, TLS, session=<qkrJc/hFpLnIIG/K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.211.219.73
country_id: 3175395
description:
2025-12-15 12:51:19 dovecot_login authenticator failed for host-62-211-219-73.pool62211.interbusiness.it ([185.196.221.176]) [62.211.219.73]:58024: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-12-15 12:52:01 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:48088: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 12:53:03 host2 sshd[4023593]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.168
country_id: 2635167
description:
Dec 15 12:52:12 host2 pure-ftpd[4022920]: (?@87.236.176.168) [INFO] New connection from 87.236.176.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 12:52:17 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:40334: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.0
country_id: 798549
description:
Dec 15 12:53:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.0, lip=66.85.158.91, session=<g5U9e/hFh8ZV2YwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-15 12:53:11 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:54742: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-15 12:53:24 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:38785: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.202.166
country_id: 2510769
description:
Dec 15 12:53:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=82.223.202.166, lip=66.85.158.91, session=<jiomffhFJtVS38qm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.181
country_id: 2960313
description:
2025-12-15 12:54:09 dovecot_login authenticator failed for (ADMIN) [37.46.113.181]:31009: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-15 12:55:29 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:35954: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-15 12:56:13 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56368: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Dec 15 12:56:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=150.95.31.158, lip=66.85.158.91, session=<HRVBiPhFoOWWXx+e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:57:13 host2 sshd[4028144]: Disconnected from invalid user james 45.118.106.54 port 57972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-15 12:58:33 dovecot_plain authenticator failed for (elving) [90.160.139.163]:59862: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.106.146
country_id: 1814991
description:
Dec 15 12:58:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.137.106.146, lip=66.85.158.91, session=<fW+zj/hFWOcIiWqS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:58:50 host2 sshd[4029572]: Disconnected from invalid user farhan 45.118.106.54 port 41223 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 12:59:38 host2 sshd[4030417]: Disconnected from invalid user zk 45.118.106.54 port 48414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 12:59:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<5NKLk/hFmO0+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 15 12:59:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<rsGgkfhFsMGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.133
country_id: 3865483
description:
Dec 15 13:00:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=45.238.106.133, lip=66.85.158.91, TLS, session=<3kU0lfhFi6ct7mqF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.4.79
country_id: 2300660
description:
Dec 15 13:00:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.139.4.79, lip=66.85.158.91, TLS, session=</rS+k/hF/MgpiwRP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.196.34
country_id: 3865483
description:
Dec 15 13:00:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=186.96.196.34, lip=66.85.158.91, TLS, session=<+LDBk/hFmoC6YMQi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.80.113
country_id: 2328926
description:
Dec 15 13:00:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.76.80.113, lip=66.85.158.91, TLS, session=<r3m4k/hF3aopTFBx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.50
country_id: 226074
description:
Dec 15 13:00:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=196.0.87.50, lip=66.85.158.91, TLS, session=<TnDBk/hFrYvEAFcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.38
country_id: 3865483
description:
Dec 15 13:00:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=179.0.249.38, lip=66.85.158.91, TLS, session=<N6zvlPhFUbCzAPkm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.219.31
country_id: 3865483
description:
Dec 15 13:00:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=186.1.219.31, lip=66.85.158.91, TLS, session=<gRQOlfhFe9O6Adsf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.100
country_id: 3865483
description:
Dec 15 13:00:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=190.181.90.100, lip=66.85.158.91, TLS, session=<th0QlfhF18u+tVpk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:01:45 host2 sshd[4032530]: Disconnected from invalid user no-reply 152.32.171.99 port 37328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.118.106.54
country_id: 1269750
description:
Dec 15 13:01:08 host2 sshd[4031983]: Disconnected from invalid user web1 45.118.106.54 port 34566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.30
country_id: 130758
description:
2025-12-15 13:01:12 dovecot_plain authenticator failed for (localhost) [62.60.135.30]:37710: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 13:03:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<qF56ofhFgLQ+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Dec 15 13:03:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<bDjhofhFMkynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.95
country_id: 130758
description:
2025-12-15 13:04:39 dovecot_plain authenticator failed for (localhost) [62.60.135.95]:35788: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 13:05:01 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:45652: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Dec 15 13:05:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<Ne/xpfhFDI+kXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:04:10 host2 sshd[4035290]: Disconnected from invalid user sherry 152.32.171.99 port 37452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 13:05:08 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:54748: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 13:06:56 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:59674: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.22
country_id: 6290252
description:
2025-12-15 13:07:00 dovecot_login authenticator failed for (ADMIN) [37.46.115.22]:41814: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-15 13:07:07 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (forrily) [68.40.189.43]:38992: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:07:59 host2 sshd[4039461]: Disconnected from invalid user rundeck 152.32.171.99 port 38346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:09:13 host2 sshd[4040596]: Disconnected from invalid user zl 152.32.171.99 port 47516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Dec 15 13:10:30 host2 sshd[4041890]: Disconnected from invalid user ubuntu 152.32.171.99 port 47248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.76.107
country_id: 2750405
description:
Dec 15 13:12:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=188.166.76.107, lip=66.85.158.91, session=<KN1Lv/hFrtC8pkxr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-15 13:11:24 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:55616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 13:13:26 host2 sshd[4044993]: Disconnected from invalid user username 62.60.131.157 port 9236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 15 13:14:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<cAUbyPhFIq6l6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Dec 15 13:15:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<+om3yvhFLJ6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Dec 15 13:15:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@lankaherbalsolutions.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ZnFly/hFypeLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 13:15:49 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:49736: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.131
country_id: 3041565
description:
2025-12-15 13:16:33 dovecot_login authenticator failed for (ADMIN) [173.239.217.131]:60278: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.133.214.127
country_id: 1269750
description:
Dec 15 13:16:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=103.133.214.127, lip=66.85.158.91, session=<cRNez/hF4OhnhdZ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-15 13:18:07 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:35347: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-12-15 13:18:07 dovecot_login authenticator failed for ([93.121.175.220]) [93.121.175.220]:41282: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Dec 15 13:18:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<N6+y1/hFxNQvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 13:18:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Kjr+1PhF+Lc+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-15 13:18:17 dovecot_login authenticator failed for ([172.82.64.201]) [172.82.64.201]:33214: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-15 13:18:20 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:50024: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 13:21:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<kTSK4fhF5tI+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.22
country_id: 2589581
description:
2025-12-15 13:22:51 dovecot_login authenticator failed for (ADMIN) [176.125.228.22]:2320: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-15 13:23:27 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:61702: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-15 13:23:13 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1180: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-15 13:28:58 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (echemenuat) [217.215.74.195]:36607: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 15 13:30:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<8nDl//hFDK4+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-15 13:31:12 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:44660: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.9
country_id: 1861060
description:
2025-12-15 13:31:27 dovecot_login authenticator failed for p160010-obmd01.osaka.ocn.ne.jp [61.112.103.9]:41323: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.229
country_id: 1733045
description:
2025-12-15 13:33:47 dovecot_login authenticator failed for ([49.124.152.229]) [49.124.152.229]:36994: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 13:33:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<260HDflF8sM+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.19
country_id: 146669
description:
2025-12-15 13:34:02 dovecot_login authenticator failed for (ADMIN) [185.253.162.19]:5156: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-12-15 13:34:13 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:49052: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 13:34:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VVkiEflFcug+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.106.153
country_id: 6252001
description:
2025-12-15 13:37:49 dovecot_login authenticator failed for (ADMIN) [191.96.106.153]:35362: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 13:40:43 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:44498: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 13:42:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<0ALgKvlFEOw+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 13:42:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<yhBdLPlFEIE+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 13:46:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<OJqjOPlFgrM+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 13:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<hQFyPPlFOO4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 13:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<OwvXQvlFAok+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.190
country_id: 798544
description:
Dec 15 13:51:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=85.202.108.190, lip=66.85.158.91, TLS, session=<dNPSSflFENxVymy+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 13:51:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57155: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.136
country_id: 3469034
description:
Dec 15 13:51:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.72.136, lip=66.85.158.91, TLS, session=<TbvySvlFHpi7eEiI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-15 13:51:55 dovecot_plain authenticator failed for (apsyrles) [102.53.15.17]:40027: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.143.253.230
country_id: 6252001
description:
2025-12-15 13:52:18 dovecot_plain authenticator failed for c-76-143-253-230.hsd1.tx.comcast.net (gerosiess) [76.143.253.230]:54000: 535 Incorrect authentication data (set_id=hr@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-15 13:53:56 dovecot_plain authenticator failed for (caphides) [105.72.176.66]:59158: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 13:54:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (subescoces) [87.103.126.54]:33063: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.84
country_id: 6252001
description:
Dec 15 13:54:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.84, lip=66.85.158.92, TLS, session=<RHeaWPlFUuHN0h9U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-15 13:56:02 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:36616: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.21
country_id: 2993457
description:
2025-12-15 13:55:23 dovecot_login authenticator failed for (ADMIN) [95.181.233.21]:45707: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-15 13:55:30 dovecot_plain authenticator failed for (localhost) [43.163.105.233]:59864: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.150
country_id: 1562822
description:
2025-12-15 13:55:53 dovecot_login authenticator failed for (ADMIN) [173.239.247.150]:33888: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.184.56
country_id: 2921044
description:
Dec 15 13:56:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.197.184.56, lip=66.85.158.91, session=<K8TGX/lFJw+Kxbg4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.115.97
country_id: 2921044
description:
Dec 15 13:56:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.115.97, lip=66.85.158.91, session=<a5vcX/lFZO8uZXNh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-15 13:56:17 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:60572: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-15 13:58:06 dovecot_login authenticator failed for (ccabv.org9.static.gvt.net.br) [187.58.241.90]:36767: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.187.91
country_id: 1643084
description:
2025-12-15 13:58:27 dovecot_plain authenticator failed for mail.mahati.id (localhost) [103.182.187.91]:45224: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-12-15 13:58:34 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:39423: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 13:59:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<9oWJavlFHOHCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 14:01:17 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:34276: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-15 14:03:13 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:56391: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-15 14:03:35 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63633: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 14:03:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Twmad/lFDLc+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-15 14:05:40 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:47618: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.138
country_id: 3865483
description:
Dec 15 14:06:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=179.0.251.138, lip=66.85.158.91, TLS, session=<P0f4gflFLISzAPuK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 14:07:53 host2 sshd[4090059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.120.168
country_id: 3865483
description:
Dec 15 14:07:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=190.181.120.168, lip=66.85.158.91, TLS, session=<A5tVg/lFb+C+tXio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.30
country_id: 130758
description:
2025-12-15 14:07:41 dovecot_plain authenticator failed for (localhost) [62.60.135.30]:42078: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.24
country_id: 1733045
description:
2025-12-15 14:08:33 dovecot_login authenticator failed for ([49.124.151.24]) [49.124.151.24]:55098: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.27
country_id: 6252001
description:
2025-12-15 14:08:49 dovecot_login authenticator failed for (ADMIN) [95.181.238.27]:34146: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-15 14:08:28 dovecot_plain authenticator failed for (localhost) [47.88.19.82]:54058: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-15 14:12:06 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:35115: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-15 14:12:14 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:51110: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-15 14:12:25 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:44940: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-15 14:12:29 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:60772: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 14:13:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ZcX3m/lFfqg+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 14:15:36 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:59880: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.95
country_id: 130758
description:
2025-12-15 14:15:49 dovecot_plain authenticator failed for (localhost) [62.60.135.95]:47830: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2025-12-15 14:16:09 dovecot_login authenticator failed for ([49.124.151.71]) [49.124.151.71]:45468: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 14:16:29 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:39588: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-15 14:16:28 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:45404: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.61
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.61: 250 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-15 14:17:16 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:33657: 535 Incorrect authentication data (set_id=env-eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-15 14:17:46 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:38228: 535 Incorrect authentication data (set_id=env.eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-15 14:17:58 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:38030: 535 Incorrect authentication data (set_id=eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-15 14:17:17 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:57955: 535 Incorrect authentication data (set_id=enveng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-15 14:17:26 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:59382: 535 Incorrect authentication data (set_id=env)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-15 14:17:38 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:59030: 535 Incorrect authentication data (set_id=enveng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-15 14:17:24 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:58036: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.94
country_id: 3175395
description:
Dec 15 14:17:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.94, lip=66.85.158.91, TLS, session=<aBSKqPlFaN3ZGrNe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-12-15 14:17:38 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:46674: 535 Incorrect authentication data (set_id=eng_env)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-12-15 14:17:47 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:44294: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-15 14:17:15 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:37714: 535 Incorrect authentication data (set_id=env@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-15 14:17:14 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59855: 535 Incorrect authentication data (set_id=eng_env@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-15 14:17:21 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:52146: 535 Incorrect authentication data (set_id=eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.239
country_id: 3865483
description:
Dec 15 14:17:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=190.184.226.239, lip=66.85.158.91, TLS, session=<QQM8p/lFkK2+uOLv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-15 14:17:25 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:52172: 535 Incorrect authentication data (set_id=engenv@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-15 14:17:33 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:55676: 535 Incorrect authentication data (set_id=engenv)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.64
country_id: 2963597
description:
Dec 15 14:19:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=37.203.49.64, lip=66.85.158.91, TLS, session=<UUlZsPlFPNglyzFA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 14:20:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<GLu4svlFNKA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.46
country_id: 3865483
description:
Dec 15 14:19:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.46, lip=66.85.158.91, TLS, session=<NsUar/lF94CzAPwu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-15 14:19:32 dovecot_plain authenticator failed for v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:40248: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-15 14:21:15 dovecot_plain authenticator failed for (zoinabiand) [176.113.155.132]:35772: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.106.39
country_id: 2623032
description:
2025-12-15 14:22:11 dovecot_login authenticator failed for (ADMIN) [46.246.106.39]:44204: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 14:23:56 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:46032: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.113
country_id: 2542007
description:
2025-12-15 14:24:44 dovecot_login authenticator failed for ([105.73.203.113]) [105.73.203.113]:34699: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.240.154
country_id: 1269750
description:
2025-12-15 14:24:56 dovecot_login authenticator failed for (static-154.240.195.14-tataidc.co.in) [14.195.240.154]:54076: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.147.214
country_id: 3017382
description:
2025-12-15 14:26:04 dovecot_login authenticator failed for ip214.ip-87-98-147.eu (ADMIN) [87.98.147.214]:52224: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.158.235
country_id: 1819730
description:
Dec 15 14:31:06 host2 sshd[4106129]: Disconnected from invalid user ftpuser 103.146.158.235 port 53600 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.205
country_id: 2635167
description:
Dec 15 14:31:33 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.205, lip=66.85.158.91, TLS, session=<jtWc2/lFieG594nN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.146.158.235
country_id: 1819730
description:
Dec 15 14:31:47 host2 sshd[4106640]: Disconnected from invalid user netadmin 103.146.158.235 port 38130 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 14:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<gjV52vlFCpY+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 14:32:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<dkKK3/lFZNY+PIdj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.146.158.235
country_id: 1819730
description:
Dec 15 14:32:26 host2 sshd[4107153]: Disconnected from invalid user imran 103.146.158.235 port 50892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:33:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<1kYH4vlF/N4DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:36:01 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<BnCM6/lFFNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.89.79
country_id: 6252001
description:
Dec 15 14:36:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.102.89.79, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PcJB7PlFfJIUZllP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 14:36:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<2JPW7flFxKU+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:37:08 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<UJmN7/lFroUDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-15 14:37:18 dovecot_plain authenticator failed for d3191.use1.stableserver.net (localhost) [190.92.171.7]:54598: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:37:29 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<h0zH8PlFsNgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 14:37:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<5ojt7/lFpNw+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.119.75.60
country_id: 6252001
description:
Dec 15 14:38:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.119.75.60, lip=66.85.158.91, session=<uWRa8/lF8NoUd0s8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-15 14:38:27 dovecot_plain authenticator failed for (localhost) [139.59.74.148]:33910: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:39:45 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<HXvn+PlFrrEDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 14:40:26 host2 sshd[4114063]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:40:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<6GzL/PlFtNsDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:40:58 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<UApJ/flFCMMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-15 14:41:35 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (estomy) [73.13.220.220]:59784: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.3
country_id: 289688
description:
2025-12-15 14:42:00 dovecot_login authenticator failed for (ADMIN) [95.181.234.3]:4775: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:42:58 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<KZ9oBPpFpMQDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 14:43:08 host2 sshd[4115581]: Disconnected from invalid user usuario 62.60.131.157 port 17128 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:43:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<4+0rB/pF8MwDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:43:47 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<dutZB/pFKsIDhBfJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 15 14:44:37 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=66.240.192.138, lip=66.85.158.91, TLS, session=<BGxXCvpF3KJC8MCK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 15 14:44:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.192.138, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Rx5aCvpFNKNC8MCK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-15 14:44:14 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:35692: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-15 14:44:32 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:47192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-15 14:45:23 dovecot_plain authenticator failed for (localhost) [114.7.163.154]:44878: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 15 14:45:40 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<lkQXDvpFJs0DhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.43
country_id: 2264397
description:
2025-12-15 14:45:56 dovecot_login authenticator failed for (ADMIN) [146.70.59.43]:22675: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-15 14:47:53 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:50229: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-15 14:48:05 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:41222: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-15 14:48:20 dovecot_plain authenticator failed for (localhost) [103.138.237.18]:18394: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-15 14:49:18 dovecot_plain authenticator failed for (nuness) [5.11.221.119]:40594: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 15 14:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<kAUsG/pF9LjBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-15 14:49:53 dovecot_plain authenticator failed for (catininn) [65.20.133.208]:42858: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 14:49:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<9uguHfpF3pI+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 14:50:17 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:38190: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-15 14:53:22 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (makles) [73.183.74.177]:51002: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 15 14:55:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<B+BEMfpFgOM+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-15 14:56:28 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:41706: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.24
country_id: 6252001
description:
2025-12-15 14:56:57 dovecot_login authenticator failed for ([72.214.133.24]) [72.214.133.24]:53843: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 14:57:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Il9/OPpFGK0+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 14:58:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<OveOOvpFFLU+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.147.238.48
country_id: 3996063
description:
Dec 15 14:59:58 host2 sshd[4127493]: Disconnected from invalid user ubuntu 189.147.238.48 port 46936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.26
country_id: 6251999
description:
2025-12-15 15:01:55 dovecot_login authenticator failed for (ADMIN) [89.149.52.26]:35050: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-15 15:04:32 dovecot_login authenticator failed for ([77.89.143.123]) [77.89.143.123]:34025: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.167
country_id: 1733045
description:
2025-12-15 15:04:16 dovecot_login authenticator failed for ([49.124.152.167]) [49.124.152.167]:49384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-15 15:05:32 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:58494: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 15:05:33 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cocks) [87.103.126.54]:32239: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-15 15:05:47 dovecot_login authenticator failed for (nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:35168: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 15:05:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<f9+hVvpF5LY+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.73.238
country_id: 6252001
description:
Dec 15 15:06:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.14.73.238, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BQFgV/pFlM8UDknu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.108
country_id: 6252001
description:
2025-12-15 15:06:21 dovecot_login authenticator failed for (ADMIN) [102.129.153.108]:34367: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-15 15:06:45 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (undon) [76.106.163.189]:42672: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.132
country_id: 1643084
description:
Dec 15 15:07:09 host2 sshd[4133333]: Disconnected from invalid user kevin 103.67.78.132 port 50078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.12
country_id: 6252001
description:
2025-12-15 15:07:52 dovecot_login authenticator failed for (172-125-13-12.lightspeed.rcsntx.sbcglobal.net) [172.125.13.12]:49138: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-15 15:08:08 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:41297: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.244
country_id: 6252001
description:
2025-12-15 15:08:21 dovecot_login authenticator failed for wsip-184-191-242-244.fv.ks.cox.net [184.191.242.244]:39229: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-15 15:08:21 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:35704: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Dec 15 15:09:02 host2 sshd[4134561]: Disconnected from invalid user autrede 103.67.78.132 port 37662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.132
country_id: 1643084
description:
Dec 15 15:10:15 host2 sshd[4135382]: Disconnected from invalid user igor 103.67.78.132 port 60848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-15 15:10:56 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:40554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 15:11:37 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:47150: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.86
country_id: 1733045
description:
2025-12-15 15:13:25 dovecot_login authenticator failed for ([49.125.201.86]) [49.125.201.86]:55284: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.30
country_id: 130758
description:
2025-12-15 15:13:59 dovecot_plain authenticator failed for (localhost) [62.60.135.30]:49038: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 15:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<RUWIc/pFCp8+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-15 15:14:35 dovecot_plain authenticator failed for (localhost) [103.27.206.6]:52030: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-15 15:15:25 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:36624: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.170
country_id: 2635167
description:
2025-12-15 15:18:55 dovecot_login authenticator failed for (ADMIN) [158.173.23.170]:62206: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 15:18:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<VmvkhPpF1N0+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-12-15 15:19:02 dovecot_plain authenticator failed for (velemensot) [46.35.178.104]:57256: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-15 15:19:54 dovecot_plain authenticator failed for c-73-55-194-114.hsd1.tx.comcast.net (boiding) [73.55.194.114]:60262: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.88.150
country_id: 6252001
description:
Dec 15 15:20:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.88.150, lip=66.85.158.92, session=<wsIVi/pFCucUDliW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-15 15:21:28 dovecot_plain authenticator failed for (localhost) [43.163.105.233]:60240: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-15 15:22:33 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (orcitiony) [67.173.58.47]:42588: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.98
country_id: 130758
description:
2025-12-15 15:24:38 dovecot_plain authenticator failed for (localhost) [62.60.135.98]:50064: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 15:24:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<f0CxmfpFEtM+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-15 15:25:42 dovecot_plain authenticator failed for (localhost) [47.88.19.82]:40562: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-15 15:26:05 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (adilms) [98.227.25.115]:33676: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 15:26:53 host2 sshd[4146504]: Disconnected from invalid user user 2.57.121.25 port 41682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.95
country_id: 130758
description:
2025-12-15 15:26:56 dovecot_plain authenticator failed for (localhost) [62.60.135.95]:42794: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.52
country_id: 2629691
description:
2025-12-15 15:27:03 dovecot_login authenticator failed for (ADMIN) [45.133.193.52]:32291: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 15:28:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Z7T3pvpFeKY+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.108
country_id: 130758
description:
2025-12-15 15:28:52 dovecot_plain authenticator failed for (localhost) [62.60.135.108]:45430: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.67.161.175
country_id: 6252001
description:
Dec 15 15:28:23 host2 pure-ftpd[4147606]: (?@40.67.161.175) [INFO] New connection from 40.67.161.175


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.187.91
country_id: 1643084
description:
2025-12-15 15:28:23 dovecot_plain authenticator failed for mail.mahati.id (localhost) [103.182.187.91]:37260: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-15 15:29:37 dovecot_plain authenticator failed for v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:48388: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 15:30:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<gGzLr/pF/oA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-15 15:31:44 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:60052: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 15:32:07 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:51312: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.92.114
country_id: 1269750
description:
Dec 15 15:31:37 host2 sshd[4149437]: Disconnected from invalid user watch 106.51.92.114 port 40601 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-15 15:32:12 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:38598: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.107
country_id: 130758
description:
2025-12-15 15:32:14 dovecot_plain authenticator failed for (localhost) [62.60.135.107]:59666: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-15 15:32:28 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:48030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.92.114
country_id: 1269750
description:
Dec 15 15:33:10 host2 sshd[4150186]: Disconnected from invalid user Test 106.51.92.114 port 54931 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 15:34:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<i6K+vPpF0rY+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.111
country_id: 1643084
description:
Dec 15 15:35:41 host2 sshd[4151657]: Disconnected from invalid user user03 103.63.25.111 port 35188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 15:36:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<rKGSwvpFDIg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.244
country_id: 798544
description:
2025-12-15 15:36:54 dovecot_login authenticator failed for (ADMIN) [138.199.59.244]:55450: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 15 15:36:55 host2 sshd[4152446]: Disconnected from invalid user anil 179.57.170.71 port 24046 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 15:37:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jD6qxfpFBO0+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.111
country_id: 1643084
description:
Dec 15 15:37:05 host2 sshd[4152546]: Disconnected from invalid user devops 103.63.25.111 port 59936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-15 15:38:06 dovecot_login authenticator failed for ([62.97.170.80]) [62.97.170.80]:52148: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-15 15:37:30 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:34810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.57.170.71
country_id: 3895114
description:
Dec 15 15:37:42 host2 sshd[4152857]: Disconnected from invalid user oracle 179.57.170.71 port 35274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.111
country_id: 1643084
description:
Dec 15 15:38:36 host2 sshd[4153532]: Disconnected from invalid user anil 103.63.25.111 port 59788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 15:40:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<miWG0PpFkq4+PIdl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.111
country_id: 1643084
description:
Dec 15 15:40:05 host2 sshd[4154492]: Disconnected from invalid user admin 103.63.25.111 port 52926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 15 15:41:08 host2 sshd[4155066]: Disconnected from invalid user admin 172.174.72.225 port 42438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 15 15:41:43 host2 sshd[4155338]: Disconnected from invalid user ftpuser 172.174.72.225 port 55406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 15:42:07 host2 sshd[4155458]: Disconnected from invalid user user 2.57.121.25 port 39665 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-15 15:42:20 dovecot_plain authenticator failed for (facessly) [5.11.140.219]:59610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 15:42:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<dx1e2vpFgOw+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 15 15:42:53 host2 sshd[4155852]: Disconnected from invalid user rahul 172.174.72.225 port 53100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 15:43:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<5kZw3vpFHL8+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 15:45:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<lMPW5PpF3rc+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec 15 15:46:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<ch4A5vpFGv/CpRCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 15:48:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<c8JC7fpFuJY+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.52
country_id: 6252001
description:
2025-12-15 15:48:54 dovecot_login authenticator failed for (ADMIN) [181.41.206.52]:21944: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-15 15:49:51 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:53958: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.137
country_id: 3865483
description:
Dec 15 15:50:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=179.0.251.137, lip=66.85.158.91, TLS, session=<zwxT9PpFgsGzAPuJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-15 15:50:45 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:43158: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.230
country_id: 953987
description:
Dec 15 15:50:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=102.129.55.230, lip=66.85.158.91, TLS, session=<+8vw9fpFDopmgTfm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.243.174.185
country_id: 2782113
description:
2025-12-15 15:52:51 dovecot_login authenticator failed for ([87.243.174.185]) [87.243.174.185]:2002: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-15 15:53:01 dovecot_plain authenticator failed for d3191.use1.stableserver.net (localhost) [190.92.171.7]:56978: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-15 15:52:39 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:48993: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.5
country_id: 1522867
description:
2025-12-15 15:53:37 dovecot_login authenticator failed for (ADMIN) [62.133.47.5]:23685: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 15:55:24 host2 sshd[4164096]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.137.131
country_id: 6252001
description:
Dec 15 15:55:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.23.137.131, lip=66.85.158.91, TLS, session=<8huFB/tFdsBAF4mD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.55.206.116
country_id: 6252001
description:
Dec 15 15:55:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin>, method=PLAIN, rip=45.55.206.116, lip=66.85.158.91, session=<sOC3B/tF1rgtN850>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.232.175
country_id: 1605651
description:
Dec 15 15:55:46 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.232.175, lip=66.85.158.92, TLS, session=<UD7CCPtF+qalmuiv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.154.232.253
country_id: 1605651
description:
Dec 15 15:55:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin>, method=PLAIN, rip=165.154.232.253, lip=66.85.158.92, session=<mufCCPtFEoalmuj9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 147.182.226.109
country_id: 6252001
description:
Dec 15 15:55:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin>, method=PLAIN, rip=147.182.226.109, lip=66.85.158.92, TLS, session=<Vf/dCPtFstSTtuJt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.207.134
country_id: 6252001
description:
Dec 15 15:55:36 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.207.134, lip=66.85.158.91, session=<W5gmCPtFao6YIM+G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.131.66
country_id: 6252001
description:
Dec 15 15:55:45 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.232.131.66, lip=66.85.158.92, session=<pgu7CPtFvOml6INC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.154.232.31
country_id: 1605651
description:
Dec 15 15:55:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin>, method=PLAIN, rip=165.154.232.31, lip=66.85.158.91, TLS, session=<A8aeB/tFQMOlmugf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 15:57:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<VY6zDftFKs8+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 15 15:57:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<jAecD/tFNqk+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 15:58:51 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:43690: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 16:00:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<GpdbGvtFBr0+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 16:02:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<2cNqIvtF+LE+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.69
country_id: 3077311
description:
Dec 15 16:05:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=217.75.222.69, lip=66.85.158.91, TLS, session=<f2YXLPtFFunZS95F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-15 16:06:04 dovecot_plain authenticator failed for (prent) [105.114.21.51]:47745: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 16:05:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<udakKvtF5Og+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.148
country_id: 3469034
description:
Dec 15 16:06:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=186.209.246.148, lip=66.85.158.91, TLS, session=<CNk3LftF5rK60faU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-15 16:07:20 dovecot_plain authenticator failed for (nessing) [109.226.14.93]:39484: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.40
country_id: 3042225
description:
2025-12-15 16:09:00 dovecot_login authenticator failed for (ADMIN) [91.90.124.40]:2430: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 16:09:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<82x8OvtFitI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.251
country_id: 2658434
description:
2025-12-15 16:11:10 dovecot_login authenticator failed for (ADMIN) [158.173.152.251]:35235: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 16:11:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<EWMpQPtFoKo+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 16:13:46 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (suckmate) [87.103.126.54]:12250: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-15 16:13:51 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:59433: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-15 16:14:19 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:13969: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 15 16:14:42 host2 sshd[4178696]: Disconnected from invalid user kafka 125.31.2.160 port 37588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.228
country_id: 3469034
description:
Dec 15 16:16:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.228, lip=66.85.158.91, TLS, session=<PuPLUvtFbpC+WYjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.160
country_id: 798544
description:
Dec 15 16:16:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=178.216.29.160, lip=66.85.158.91, TLS, session=<7umnUftFT8uy2B2g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-15 16:17:51 dovecot_plain authenticator failed for (localhost) [103.138.237.18]:15818: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.62.121
country_id: 2510769
description:
Dec 15 16:18:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=178.156.62.121, lip=66.85.158.91, TLS, session=<n+izWftF5tiynD55>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.138
country_id: 953987
description:
Dec 15 16:19:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=102.64.40.138, lip=66.85.158.91, TLS, session=<p1XWWvtFKbJmQCiK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 16:20:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</YaAX/tFcKI+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 15 16:20:52 host2 sshd[4182602]: Disconnected from invalid user ubuntu 125.31.2.160 port 45582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.31.2.160
country_id: 1821275
description:
Dec 15 16:21:27 host2 sshd[4183205]: Disconnected from invalid user admin 125.31.2.160 port 58422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.240
country_id: 1643084
description:
Dec 15 16:23:11 host2 sshd[4184262]: Disconnected from invalid user oe 103.31.39.240 port 53148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-15 16:27:08 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:47245: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-15 16:26:13 dovecot_plain authenticator failed for (localhost) [139.59.74.148]:39170: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.31.39.240
country_id: 1643084
description:
Dec 15 16:26:48 host2 sshd[4186882]: Disconnected from invalid user pzuser 103.31.39.240 port 48682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.169
country_id: 3041565
description:
2025-12-15 16:26:50 dovecot_login authenticator failed for (ADMIN) [173.239.217.169]:55188: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.89
country_id: 3996063
description:
2025-12-15 16:27:01 dovecot_login authenticator failed for (201.173.216.89-clientes-izzi.mx) [201.173.216.89]:48532: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 16:27:57 host2 sshd[4187497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-15 16:27:35 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:36239: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-15 16:27:49 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:46402: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.240
country_id: 1643084
description:
Dec 15 16:28:59 host2 sshd[4188167]: Disconnected from invalid user ftpuser 103.31.39.240 port 59870 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-15 16:31:31 dovecot_plain authenticator failed for (localhost) [114.7.163.154]:32842: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.219
country_id: 2921044
description:
2025-12-15 16:32:07 dovecot_login authenticator failed for (ADMIN) [212.102.57.219]:38588: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.14.178.19
country_id: 6252001
description:
Dec 15 16:34:46 host2 sshd[4191463]: Disconnected from invalid user ying 72.14.178.19 port 41048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 16:35:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<PiLSlvtFlrE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.202
country_id: 1733045
description:
2025-12-15 16:38:58 dovecot_login authenticator failed for ([49.124.149.202]) [49.124.149.202]:57336: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.248
country_id: 6252001
description:
2025-12-15 16:39:31 dovecot_login authenticator failed for ([98.185.121.248]) [98.185.121.248]:35146: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Dec 15 16:40:27 host2 sshd[1313]: Disconnected from invalid user user12 162.241.127.152 port 43662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-15 16:40:34 dovecot_plain authenticator failed for v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:43998: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.127.152
country_id: 6252001
description:
Dec 15 16:41:05 host2 sshd[1800]: Disconnected from invalid user kira 162.241.127.152 port 56648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Dec 15 16:42:22 host2 sshd[2678]: Disconnected from invalid user shoutcast 162.241.127.152 port 54396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.88.19.82
country_id: 6252001
description:
2025-12-15 16:42:28 dovecot_plain authenticator failed for (localhost) [47.88.19.82]:36016: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.23
country_id: 614540
description:
2025-12-15 16:42:57 dovecot_login authenticator failed for (ADMIN) [95.181.236.23]:38524: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 16:45:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<y66/uftFJqY+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:46:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9mY5vftFVLwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.21
country_id: 6252001
description:
2025-12-15 16:46:16 dovecot_login authenticator failed for ([98.185.120.21]) [98.185.120.21]:38130: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-12-15 16:46:33 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:33726: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-15 16:46:36 dovecot_plain authenticator failed for (localhost) [43.163.105.233]:57892: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-15 16:48:01 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (intridly) [73.199.161.144]:41524: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:48:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<0cWZw/tFaqIDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 15 16:47:14 host2 sshd[6315]: Disconnected from invalid user user 146.190.79.63 port 52344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 16:50:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wW6UyvtFqOA+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:50:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=</6cAzPtFPq0DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 16:51:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<6Gxlz/tF3IE+PIde>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Dec 15 16:52:38 host2 sshd[9295]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 58996 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Dec 15 16:52:38 host2 sshd[9295]: Disconnecting authenticating user root 173.24.18.140 port 58996: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.24.18.140
country_id: 6252001
description:
Dec 15 16:52:45 host2 sshd[9339]: Disconnecting invalid user admin 173.24.18.140 port 60300: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:52:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<mL9k1ftFnM8DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 16:53:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<fvkv1vtFmJ4+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 15 16:53:42 host2 sshd[9829]: Disconnected from invalid user mmd 123.58.213.52 port 50340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-12-15 16:53:49 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:39843: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-15 16:53:54 dovecot_plain authenticator failed for (localhost) [103.27.206.6]:49342: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-15 16:53:59 dovecot_login authenticator failed for ([78.156.6.163]) [78.156.6.163]:37286: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:54:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TVDo2/tFKJQDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 15 16:55:43 host2 sshd[11924]: Disconnected from invalid user mmd 193.70.86.193 port 34832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 15 16:55:12 host2 sshd[11503]: Disconnected from invalid user notify 193.70.86.193 port 48284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 16:55:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<9pVx3ftF4KY+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:55:36 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<la7D3vtFcskDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 16:57:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<cMLS4/tFjtM+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:56:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Eouy4ftF6IwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.36
country_id: 798549
description:
2025-12-15 16:57:15 dovecot_login authenticator failed for (ADMIN) [143.244.52.36]:54998: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.24
country_id: 2029969
description:
2025-12-15 16:59:03 dovecot_login authenticator failed for (ADMIN) [173.244.58.24]:32836: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:59:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<cvwt6/tFzKIDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 15 16:59:19 host2 sshd[14167]: Disconnected from invalid user botuser 123.58.213.52 port 54092 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 16:59:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<KJxA7ftFYqMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-15 16:59:42 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:57340: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.187.91
country_id: 1643084
description:
2025-12-15 16:59:45 dovecot_plain authenticator failed for mail.mahati.id (localhost) [103.182.187.91]:53474: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-15 17:00:16 dovecot_login authenticator failed for h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:56610: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-15 17:01:33 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:54670: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 15 17:01:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<qdZt9PtFRKUDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 17:01:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Fyji9PtFnO0+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.122
country_id: 2635167
description:
2025-12-15 17:02:56 dovecot_login authenticator failed for (mail3.hurst.co.uk) [77.89.143.122]:58344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-15 17:03:08 dovecot_plain authenticator failed for (culoulky) [65.20.174.63]:37212: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-15 17:02:46 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (flenth) [73.197.236.163]:50682: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-12-15 17:02:45 dovecot_login authenticator failed for ([77.95.56.101]) [77.95.56.101]:46085: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 17:02:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<+wF++PtFBp8+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-15 17:04:26 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:38636: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-15 17:08:04 dovecot_plain authenticator failed for d3191.use1.stableserver.net (localhost) [190.92.171.7]:38840: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 17:08:07 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:54654: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 17:07:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<5RGrCPxFMpA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-15 17:08:11 dovecot_plain authenticator failed for d3191.use1.stableserver.net (localhost) [190.92.171.7]:47844: 535 Incorrect authentication data (set_id=webmaster@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.122.102
country_id: 2921044
description:
2025-12-15 17:08:14 dovecot_plain authenticator failed for (localhost) [46.101.122.102]:58814: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2635167
description:
Dec 15 17:10:22 host2 sshd[21340]: Disconnected from invalid user xmr 45.151.182.15 port 57370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 17:14:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zzOIIvxF4OA+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2635167
description:
Dec 15 17:15:22 host2 sshd[24846]: Disconnected from invalid user samr 45.151.182.15 port 60040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 17:15:25 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (suried) [87.103.126.54]:5452: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.233
country_id: 1819730
description:
Dec 15 17:15:58 host2 sshd[25187]: Disconnected from invalid user testuser1 101.36.107.233 port 41092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Dec 15 17:16:30 host2 sshd[25564]: Disconnected from invalid user bot 197.248.8.33 port 45296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-12-15 17:18:07 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:48562: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 17:17:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<v5QBLPxFsMQ+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-12-15 17:17:31 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:35348: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 15 17:17:39 host2 sshd[26192]: Disconnected from invalid user username 154.91.170.52 port 47170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 15 17:18:48 host2 sshd[26878]: Disconnected from invalid user vps 154.91.170.52 port 40410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.124
country_id: 6252001
description:
2025-12-15 17:19:10 dovecot_login authenticator failed for (ADMIN) [102.129.252.124]:35608: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Dec 15 17:19:59 host2 sshd[27634]: Disconnected from invalid user james 154.91.170.52 port 42674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 17:20:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<qzczNvxFhtQ+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-15 17:20:28 dovecot_plain authenticator failed for (phofts) [102.53.15.56]:49768: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.23
country_id: 2264397
description:
2025-12-15 17:20:30 dovecot_login authenticator failed for (ADMIN) [146.70.59.23]:29599: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.57.113
country_id: 1269750
description:
Dec 15 17:21:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=103.237.57.113, lip=66.85.158.91, TLS, session=<h6M+OvxFxZBn7Tlx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.67.199
country_id: 458258
description:
Dec 15 17:21:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=85.255.67.199, lip=66.85.158.91, TLS, session=<HCBzO/xF3xJV/0PH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.142.154.100
country_id: 1819730
description:
Dec 15 17:24:50 host2 pure-ftpd[31027]: (?@45.142.154.100) [INFO] New connection from 45.142.154.100


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-15 17:26:51 dovecot_plain authenticator failed for (unsoxy) [81.0.54.119]:45184: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-15 17:26:55 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (radazing) [68.82.141.145]:35488: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 15 17:31:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<MqPnX/xFytc+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-15 17:31:57 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:56758: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-15 17:32:23 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:48813: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 15 17:34:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<t4L/aPxFXIo+PIdg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 15 17:35:03 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<n/Dba/xF+MiLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 17:35:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<Xt7Ma/xFjLo+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.14
country_id: 146669
description:
2025-12-15 17:36:12 dovecot_login authenticator failed for (ADMIN) [185.253.162.14]:23728: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 17:37:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<cD1hc/xFrtI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-15 17:39:57 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (horgic) [73.197.194.98]:55560: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.4
country_id: 732800
description:
Dec 15 17:41:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=185.255.212.4, lip=66.85.158.91, TLS, session=<l2qRgvxFHbC5/9QE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.31
country_id: 690791
description:
Dec 15 17:42:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=176.103.5.31, lip=66.85.158.91, TLS, session=<ldS7g/xFWqywZwUf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 17:42:58 host2 sshd[43463]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.115
country_id: 2623032
description:
2025-12-15 17:43:08 dovecot_login authenticator failed for (ADMIN) [188.126.94.115]:7474: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 17:47:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wyVvlvxFbso+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-15 17:48:45 dovecot_login authenticator failed for ([125.18.67.17]) [182.95.112.146]:59712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-15 17:49:18 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:57418: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 17:49:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<E8Fun/xFxM7Cw3NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 17:50:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<e30NovxFsI0+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-15 17:51:14 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (sunisbake) [98.40.101.10]:46518: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.76
country_id: 2782113
description:
2025-12-15 17:53:17 dovecot_login authenticator failed for (ADMIN) [156.146.60.76]:30078: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 17:53:33 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62551: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-15 17:55:49 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:59234: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-15 17:56:02 dovecot_login authenticator failed for ([182.95.7.193]) [182.95.59.154]:40756: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-15 17:56:37 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (ressnes) [24.91.103.202]:41974: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 17:56:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<c+7uufxFmtA+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.222
country_id: 1819730
description:
2025-12-15 17:57:05 dovecot_login authenticator failed for 222.42.246.220.static.netvigator.com [220.246.42.222]:53191: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-15 17:57:26 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:60230: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-15 17:57:52 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (belica) [68.60.77.128]:54706: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 15 18:01:17 host2 sshd[56614]: Disconnected from invalid user user 2.57.121.25 port 22910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-15 18:02:50 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (oderous) [76.16.7.82]:60985: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 15 18:04:42 host2 sshd[59098]: Disconnected from invalid user space 45.232.73.84 port 57256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-15 18:05:19 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (trishies) [24.23.125.83]:55496: 535 Incorrect authentication data (set_id=hr@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 15 18:05:25 host2 sshd[59695]: Disconnected from invalid user bitwarden 45.232.73.84 port 41596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 15 18:06:12 host2 sshd[60192]: Disconnected from invalid user luna 45.232.73.84 port 54174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Dec 15 18:07:36 host2 sshd[60983]: Disconnected from invalid user vpn 45.232.73.84 port 51116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-15 18:07:46 dovecot_plain authenticator failed for (antiess) [102.53.15.56]:56308: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-15 18:08:26 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:32997: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.150
country_id: 1269750
description:
2025-12-15 18:08:51 dovecot_login authenticator failed for ([152.52.56.25]) [182.95.226.150]:37176: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 15 18:09:49 host2 sshd[62490]: Disconnecting invalid user admin 98.191.229.175 port 59958: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 15 18:09:45 host2 sshd[62432]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 58690 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 15 18:09:45 host2 sshd[62432]: Disconnecting authenticating user root 98.191.229.175 port 58690: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.191.229.175
country_id: 6252001
description:
Dec 15 18:09:48 host2 sshd[62480]: error: maximum authentication attempts exceeded for invalid user admin from 98.191.229.175 port 59716 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 15 18:11:26 host2 sshd[63610]: Disconnected from invalid user user 81.215.228.18 port 56176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 15 18:11:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<PWey7vxF0ok+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.107
country_id: 3996063
description:
2025-12-15 18:11:46 dovecot_login authenticator failed for (ADMIN) [77.81.142.107]:44950: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.114
country_id: 2661886
description:
2025-12-15 18:12:42 dovecot_login authenticator failed for (ADMIN) [46.246.8.114]:29934: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.15.157.90
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.15.157.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 15 18:13:06 host2 sshd[64705]: Disconnected from invalid user ubuntu 186.248.197.77 port 43865 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 15 18:14:05 host2 sshd[65296]: Disconnected from invalid user openstack 81.215.228.18 port 33492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-15 18:14:41 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (pervia) [73.145.107.251]:43726: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 15 18:14:12 host2 sshd[65366]: Disconnected from invalid user bayu 45.182.207.45 port 35632 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 18:15:44 host2 sshd[66537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.248.197.77
country_id: 3469034
description:
Dec 15 18:15:21 host2 sshd[66322]: Disconnected from invalid user ubuntu 186.248.197.77 port 30820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-15 18:16:50 dovecot_login authenticator failed for ([84.211.13.217]) [84.211.13.217]:36038: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.111
country_id: 2635167
description:
Dec 15 18:17:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.111, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+sbCAv1FA8q594lv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.124
country_id: 2635167
description:
Dec 15 18:17:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.124, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<g0G+BP1Fo6lX7LB8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 18:17:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Vz5LAv1FLOs+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.56
country_id: 1733045
description:
2025-12-15 18:17:13 dovecot_login authenticator failed for ([49.124.153.56]) [49.124.153.56]:45672: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.10
country_id: 2635167
description:
Dec 15 18:17:14 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.10, lip=66.85.158.92, TLS, session=<eXKzAv1Fldm594kK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 18:17:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qSFAA/1FgLE+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 15 18:17:37 host2 sshd[67726]: Disconnected from invalid user idempiere 167.71.36.180 port 12422 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.120
country_id: 2635167
description:
Dec 15 18:18:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.120, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<XMu5Bv1FE51X7LB4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 18:18:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4ZMvB/1FasE+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.140
country_id: 2635167
description:
Dec 15 18:18:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.140, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<chO1CP1FabdX7LCM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.110
country_id: 2635167
description:
Dec 15 18:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<57epDP1FveVX7LBu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.112
country_id: 2635167
description:
Dec 15 18:19:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.112, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<LVCwCv1FebJX7LBw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-15 18:19:42 dovecot_login authenticator failed for ([180.94.76.126]) [180.94.76.126]:47814: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Dec 15 18:19:56 host2 sshd[69169]: Disconnected from invalid user webadmin 45.182.207.45 port 57654 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.145
country_id: 2635167
description:
Dec 15 18:20:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4fWmDv1Fja9X7LCR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.120
country_id: 2635167
description:
Dec 15 18:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.120, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<o1+iEP1FeYpX7LB4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-15 18:21:29 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (ciloify) [196.47.172.253]:36079: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Dec 15 18:21:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Qq+bEv1FQdC594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.119
country_id: 2635167
description:
Dec 15 18:22:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.119, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<sQKXFP1F2+a594l3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 18:28:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<mxylKf1Fypk+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 18:30:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<NY4LMv1FjqY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-12-15 18:31:21 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:53389: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.60
country_id: 2077456
description:
2025-12-15 18:31:26 dovecot_login authenticator failed for (ADMIN) [179.61.228.60]:5390: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-15 18:32:08 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:43414: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 18:34:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<h9nrPv1FGrQ+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.246
country_id: 6290252
description:
Dec 15 18:36:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=109.207.34.246, lip=66.85.158.91, TLS, session=<fTXWRf1FLK1tzyL2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.202
country_id: 3865483
description:
Dec 15 18:36:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.0.251.202, lip=66.85.158.91, TLS, session=<Mr/9Rv1F8N+zAPvK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.106
country_id: 6252001
description:
2025-12-15 18:36:53 dovecot_login authenticator failed for (ADMIN) [95.181.238.106]:34497: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-12-15 18:36:59 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:49402: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-15 18:37:18 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:44506: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.70.71
country_id: 2921044
description:
Dec 15 18:38:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.70.71, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<k00nTv1F+11Et0ZH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.76.127
country_id: 2921044
description:
Dec 15 18:38:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=138.68.76.127, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wq9FUP1FRCiKREx/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 18:41:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<wEBtWf1FkLQ+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 15 18:45:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<z8fIZ/1FR//CpRCm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.97
country_id: 298795
description:
Dec 15 18:46:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=95.0.171.97, lip=66.85.158.91, TLS, session=<pVFOaf1F5M9fAKth>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.204
country_id: 3469034
description:
Dec 15 18:46:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.89.136.204, lip=66.85.158.91, TLS, session=<Pilyav1F372+WYjM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-15 18:50:21 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (hemea) [73.129.57.71]:46848: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-15 18:50:26 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (hympsty) [73.144.27.228]:44570: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-15 19:04:03 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (manku) [73.88.196.91]:52142: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.96
country_id: 2635167
description:
2025-12-15 19:05:30 dovecot_login authenticator failed for (ADMIN) [194.110.13.96]:47629: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 19:06:37 host2 sshd[102723]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-15 19:08:00 dovecot_plain authenticator failed for (mectitchs) [105.114.21.51]:56334: 535 Incorrect authentication data (set_id=hr@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-15 19:08:22 dovecot_plain authenticator failed for (rotilly) [5.11.140.219]:54186: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.46
country_id: 3057568
description:
2025-12-15 19:08:34 dovecot_login authenticator failed for (ADMIN) [149.102.232.46]:20795: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 19:11:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<w90sw/1F1s0+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 19:11:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<6vDFw/1FyJs+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2025-12-15 19:13:35 dovecot_login authenticator failed for ([193.23.199.238]) [193.23.199.238]:32822: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-15 19:14:03 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:58317: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-15 19:21:48 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (alnes) [73.161.96.107]:46298: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 19:24:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<ncbs8v1FTpI+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.55
country_id: 2542007
description:
2025-12-15 19:25:22 dovecot_login authenticator failed for (ADMIN) [95.181.232.55]:28843: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-15 19:25:40 dovecot_plain authenticator failed for (surophitel) [91.73.188.251]:45567: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.92
country_id: 2658434
description:
2025-12-15 19:25:51 dovecot_login authenticator failed for (ADMIN) [158.173.152.92]:30903: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-15 19:26:34 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:49266: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-12-15 19:26:51 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:58716: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 19:27:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<OiAV//1FDts+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 15 19:29:26 host2 sshd[121636]: Disconnected from invalid user star 176.123.2.69 port 37278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.123.2.69
country_id: 617790
description:
Dec 15 19:30:33 host2 sshd[122823]: Disconnected from invalid user dummy 176.123.2.69 port 59002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 19:32:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<cXgIDv5FEJc+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.123.2.69
country_id: 617790
description:
Dec 15 19:31:42 host2 sshd[123775]: Disconnected from invalid user test_user 176.123.2.69 port 34218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 19:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<TS4JE/5FmOI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-15 19:35:40 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:52210: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.240
country_id: 6252001
description:
2025-12-15 19:35:52 dovecot_login authenticator failed for wsip-184-191-242-240.fv.ks.cox.net [184.191.242.240]:43672: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.143.226.68
country_id: 3686110
description:
Dec 15 19:36:53 host2 sshd[127674]: Disconnected from invalid user ubuntu 181.143.226.68 port 41528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.143.226.68
country_id: 3686110
description:
Dec 15 19:38:47 host2 sshd[128845]: Disconnected from invalid user test_user 181.143.226.68 port 45072 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 19:39:20 host2 sshd[129359]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.143.226.68
country_id: 3686110
description:
Dec 15 19:42:06 host2 sshd[131159]: Disconnected from invalid user test 181.143.226.68 port 34232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.30
country_id: 6252001
description:
2025-12-15 19:43:59 dovecot_login authenticator failed for (ADMIN) [95.181.238.30]:53224: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.66.12
country_id: 6252001
description:
2025-12-15 19:45:52 dovecot_login authenticator failed for ([98.181.66.12]) [98.181.66.12]:35667: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Dec 15 19:47:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QEQtRP5FOk5BMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2025-12-15 19:46:19 dovecot_login authenticator failed for ([196.190.43.139]) [196.190.41.137]:25467: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 19:46:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<STCLQv5FmJg+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 19:46:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<aGPIQv5For0+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Dec 15 19:47:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IAhXRf5FeIJBMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.13
country_id: 2993457
description:
2025-12-15 19:49:06 dovecot_login authenticator failed for (ADMIN) [95.181.233.13]:10978: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.194
country_id: 2635167
description:
Dec 15 19:54:34 host2 pure-ftpd[140780]: (?@185.247.137.194) [INFO] New connection from 185.247.137.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-15 19:55:03 dovecot_plain authenticator failed for (sondating) [91.73.188.251]:40503: 535 Incorrect authentication data (set_id=hr@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.102
country_id: 953987
description:
Dec 15 19:55:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.129.57.102, lip=66.85.158.91, TLS, session=<vZXuYf5FIe5mgTlm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.142.90
country_id: 690791
description:
Dec 15 19:56:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=37.221.142.90, lip=66.85.158.91, TLS, session=<M9lTY/5FEZYl3Y5a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 19:55:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<fl5DYv5F9Kg+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-15 19:58:06 dovecot_plain authenticator failed for (turemet) [199.192.123.12]:42928: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-15 19:59:05 dovecot_plain authenticator failed for (vulnetory) [24.105.248.218]:39632: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-15 19:58:48 dovecot_plain authenticator failed for (spergod) [65.20.148.194]:45534: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-15 20:00:48 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:53518: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-15 20:00:49 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:56336: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2025-12-15 20:00:21 dovecot_login authenticator failed for (187-163-97-62.cust.smartcall.no) [62.97.163.187]:58131: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.11
country_id: 3996063
description:
2025-12-15 20:01:51 dovecot_login authenticator failed for (189.218.82.11-clientes-izzi.mx) [189.218.82.11]:33381: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-15 20:02:12 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:39323: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.9
country_id: 3057568
description:
2025-12-15 20:04:00 dovecot_login authenticator failed for (ADMIN) [149.102.232.9]:11710: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-15 20:03:34 dovecot_plain authenticator failed for (quizerize) [65.20.129.28]:48102: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-15 20:04:55 dovecot_plain authenticator failed for (oorner) [65.20.133.208]:45437: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 20:05:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<0xlQh/5F8KI+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 15 20:07:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<rd/Ljf5F6Ic+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 20:09:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Y2KJkv5FIK0+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 20:09:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<VoI6lf5Ftpw+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-15 20:10:35 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:41270: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 20:10:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<FBCdmP5FqJ8+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-12-15 20:10:21 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:34824: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 20:12:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<5t8lnv5FPoA+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 20:13:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<bi7tov5FFMY+PIdm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 20:14:14 host2 sshd[154608]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-15 20:16:58 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (cophies) [75.74.211.27]:39123: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.9
country_id: 6252001
description:
2025-12-15 20:19:32 dovecot_login authenticator failed for ([98.185.120.9]) [98.185.120.9]:41013: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-15 20:19:54 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:38311: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 15 20:20:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<m6sou/5Fms7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 20:25:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<Gbqmy/5FsNM+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-15 20:25:39 dovecot_login authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:57140: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.38
country_id: 1861060
description:
2025-12-15 20:25:42 dovecot_login authenticator failed for (ADMIN) [149.22.87.38]:42874: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-15 20:25:20 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:58656: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-15 20:25:35 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:39832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-15 20:26:15 dovecot_login authenticator failed for ([177.236.146.222]) [177.236.146.222]:42389: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 15 20:33:52 host2 sshd[168423]: Disconnected from invalid user jerry 45.131.135.89 port 49820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 15 20:34:25 host2 sshd[168728]: Disconnected from invalid user zxc 45.131.135.89 port 46604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 20:34:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<PHFo7v5FgKw+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 15 20:34:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<AiYx7/5F3f7CpRCj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 15 20:35:26 host2 sshd[169457]: Disconnected from invalid user debian 45.131.135.89 port 43570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 20:37:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<rWLQ+P5FHuw+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-12-15 20:37:40 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:59910: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-12-15 20:37:55 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:44881: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.91
country_id: 130758
description:
Dec 15 20:38:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.91, lip=66.85.158.91, session=<Oocx+/5FMsI+PIdb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-15 20:38:36 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:33306: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-12-15 20:38:53 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:49108: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 15 20:40:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<eQudAf9Ft94jy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-15 20:40:09 dovecot_plain authenticator failed for (stiestic) [65.20.250.163]:50825: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Dec 15 20:41:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<JisTBP9Fx5+yMLU6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 15 20:40:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.210.214, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<q1HuA/9FpuIjy9LW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.86.200.24
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.86.200.24 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 15 20:41:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.214, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<FtmzBf9F6uAjy9LW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.94
country_id: 3469034
description:
Dec 15 20:41:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.216.88.94, lip=66.85.158.91, TLS, session=<yMQ3Bf9FMLK62Fhe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 20:41:31 host2 sshd[173917]: Disconnected from invalid user maranda 62.60.131.157 port 32724 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 20:43:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<b4BcDf9F/tI+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-15 20:43:52 dovecot_plain authenticator failed for 78-66-119-139-no600.tbcn.telia.com (visaria) [78.66.119.139]:34820: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 20:44:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<NDT8EP9Fto8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.25
country_id: 1522867
description:
2025-12-15 20:45:19 dovecot_login authenticator failed for (ADMIN) [62.133.47.25]:46982: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 20:47:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<a9vGGv9FRqg+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.214
country_id: 2635167
description:
Dec 15 20:46:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.214, lip=66.85.158.92, TLS, session=<7A4KGf9FMukjy9LW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.201
country_id: 294640
description:
2025-12-15 20:47:03 dovecot_login authenticator failed for (ADMIN) [149.88.26.201]:8343: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 20:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<CSevGv9FYso+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 20:48:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<qpjEHf9FBsI+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.236.125.163
country_id: 294640
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 147.236.125.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.145.198.129
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.145.198.129 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.54.120.204
country_id: 1512440
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 84.54.120.204 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.201.155
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.43.201.155 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.136.243
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.100.136.243 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.67.119
country_id: 1282988
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 27.34.67.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.59.217.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.59.217.75 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.108
country_id: 6252001
description:
2025-12-15 20:48:53 dovecot_login authenticator failed for wsip-184-191-250-108.fv.ks.cox.net [184.191.250.108]:43340: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 15 20:50:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Yj5FJf9FiP8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.17
country_id: 6252001
description:
2025-12-15 20:49:26 dovecot_login authenticator failed for wsip-184-191-243-17.fv.ks.cox.net [184.191.243.17]:35374: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 20:50:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<EjnlJf9FuuM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 15 20:52:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<t9LXLP9F0KE+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.81
country_id: 2542007
description:
2025-12-15 20:52:21 dovecot_plain authenticator failed for (reful) [105.73.203.81]:51734: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 20:54:21 host2 sshd[182978]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 20:56:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<YHn7O/9F4pY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 20:56:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<0VTYPP9FTLA+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 15 20:57:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<hOKqP/9FPp4+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 20:59:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<luW5Rv9Ftts+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 15 21:00:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<fYXdS/9Fvv7CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 15 21:01:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<ybGwTf9FkrA+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 15 21:03:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<AW3cVf9FuM4+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.10
country_id: 174982
description:
2025-12-15 21:03:57 dovecot_login authenticator failed for (ADMIN) [185.253.160.10]:18983: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 21:04:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<qjeKV/9FiLg+PIdi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 15 21:03:37 host2 sshd[189229]: Disconnected from invalid user vncuser 162.240.156.34 port 59018 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.220.85
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.105.220.85 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.26.170.227
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.26.170.227 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.195.157.74
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 168.195.157.74 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.33.235.214
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.33.235.214 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.60.102
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.196.60.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.145.20
country_id: 587116
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 62.217.145.20 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.76.74.105
country_id: 798549
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 82.76.74.105 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 21:05:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<OuM8XP9F4MM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.8.250.134
country_id: 6252001
description:
2025-12-15 21:05:30 dovecot_login authenticator failed for ([4.8.250.134]) [4.8.250.134]:50190: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-15 21:05:48 dovecot_login authenticator failed for (cm-178.232.197.135.get.no) [178.232.197.135]:43744: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 15 21:07:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<dtn2Yv9FmKzCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-15 21:08:00 dovecot_plain authenticator failed for (forie) [65.20.160.107]:56324: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-15 21:08:49 dovecot_login authenticator failed for (cm-178.232.122.247.get.no) [178.232.122.247]:45605: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-15 21:09:09 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:43479: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 21:09:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<zh6+a/9FZMk+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.70
country_id: 298795
description:
2025-12-15 21:09:54 dovecot_login authenticator failed for (ADMIN) [188.213.34.70]:56174: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Dec 15 21:10:56 host2 sshd[194878]: Disconnected from invalid user vncuser 134.122.121.56 port 39926 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.121.56
country_id: 6252001
description:
Dec 15 21:11:48 host2 sshd[195537]: Disconnected from invalid user administrator 134.122.121.56 port 58766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 15 21:12:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Lv+gc/9FaOU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-15 21:14:02 dovecot_plain authenticator failed for (ancen) [65.20.148.194]:44321: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.245.70
country_id: 3996063
description:
2025-12-15 21:14:42 dovecot_login authenticator failed for (189.219.245.70-clientes-izzi.mx) [189.219.245.70]:43706: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-12-15 21:14:59 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:34836: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 21:15:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<sVnAfv9FdIA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 21:15:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<nt90f/9FwqU+PIM0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.14.194.128
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.14.194.128 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-15 21:17:36 dovecot_plain authenticator failed for (vaticks) [105.72.176.66]:44616: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-15 21:17:47 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:43206: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-15 21:18:01 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:50720: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 15 21:19:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<qkycjf9F2uE+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.16
country_id: 3042225
description:
2025-12-15 21:19:21 dovecot_login authenticator failed for (ADMIN) [91.90.124.16]:46918: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.90.185
country_id: 6252001
description:
Dec 15 21:19:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=64.227.90.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<dVyPjv9FYNZA41q5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.144.246.132
country_id: 798544
description:
Dec 15 21:20:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.144.246.132, lip=66.85.158.91, TLS, session=<AlXDkP9FRL65kPaE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-15 21:20:28 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:48854: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-15 21:20:46 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:37953: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.74
country_id: 933860
description:
Dec 15 21:20:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=41.216.209.74, lip=66.85.158.91, TLS, session=<tRblkf9FGN4p2NFK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Dec 15 21:22:45 host2 sshd[202683]: Disconnected from invalid user vitor 134.122.121.56 port 45424 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 21:23:32 host2 sshd[203110]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 21:23:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<5FLfnP9FEIA+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-15 21:23:57 dovecot_plain authenticator failed for c-73-21-28-14.hsd1.ga.comcast.net (viontly) [73.21.28.14]:33444: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2025-12-15 21:26:00 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:52426: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 21:27:07 host2 sshd[205935]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-15 21:26:17 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:32945: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.48.204
country_id: 6252001
description:
Dec 15 21:27:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.83.48.204, lip=66.85.158.92, session=<dZ2LrP9FyLIUUzDM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-15 21:29:05 dovecot_plain authenticator failed for (sionon) [65.20.160.107]:46698: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 15 21:29:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, session=<osM0sf9FFrXY2s5D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 15 21:30:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<5Shttf9F4uc+PIdi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.128.101
country_id: 1733045
description:
Dec 15 21:31:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.250.128.101, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<gMRjuP9F/FAv+oBl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.22
country_id: 3625428
description:
2025-12-15 21:33:57 dovecot_login authenticator failed for (ADMIN) [95.181.237.22]:45901: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-15 21:35:05 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (whaing) [73.27.33.174]:47744: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-15 21:35:09 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (tengurceld) [174.169.224.27]:37992: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 15 21:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<erBbyf9Fbp4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-15 21:37:50 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:35478: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-12-15 21:38:21 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:49581: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-15 21:40:43 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:61611: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 21:40:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<gjIE2/9F6MQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.43
country_id: 6252001
description:
2025-12-15 21:41:12 dovecot_login authenticator failed for (ADMIN) [216.24.213.43]:16892: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-15 21:41:24 dovecot_login authenticator failed for ([103.111.109.194]) [103.111.109.194]:49768: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-15 21:43:00 dovecot_plain authenticator failed for (oushetical) [105.114.21.51]:33681: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.96
country_id: 6252001
description:
Dec 15 21:45:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=147.185.133.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<XEHD6f9FNNmTuYVg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.96
country_id: 6252001
description:
Dec 15 21:46:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.133.96, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gKHO8P9FcPeTuYVg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.96
country_id: 6252001
description:
Dec 15 21:47:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.96, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Y4Sj8v9FHvqTuYVg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-15 21:47:52 dovecot_plain authenticator failed for (ariachitit) [91.73.188.251]:45977: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.30
country_id: 3042225
description:
2025-12-15 21:47:19 dovecot_login authenticator failed for (ADMIN) [91.90.124.30]:38375: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-15 21:50:41 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (quegest) [67.173.58.47]:38828: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-15 21:53:23 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:26529: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.96
country_id: 6252001
description:
Dec 15 21:53:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.96, lip=66.85.158.91, TLS, session=<mdeLCABG7OeTuYVg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.38
country_id: 1733045
description:
2025-12-15 21:53:59 dovecot_login authenticator failed for ([49.124.153.38]) [49.124.153.38]:40926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-15 21:54:09 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:35088: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 15 21:55:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, session=<fAakDQBG4O5KUi8C>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.234.225.9
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 200.234.225.9 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.96
country_id: 6252001
description:
Dec 15 21:54:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.96, lip=66.85.158.91, TLS, session=<sg9RCwBGsuuTuYVg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 15 21:55:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS: Connection closed, session=<GJh5DgBGPj1KUi8C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 15 21:55:36 host2 sshd[239762]: Disconnected from invalid user ubuntu 35.199.95.142 port 43428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.142
country_id: 690791
description:
Dec 15 21:55:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=37.221.159.142, lip=66.85.158.91, TLS, session=<VwuHDwBGlrMl3Z+O>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Dec 15 21:55:54 host2 sshd[240026]: Disconnected from invalid user php 107.175.70.59 port 48742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.221
country_id: 3469034
description:
Dec 15 21:56:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.137.221, lip=66.85.158.91, TLS, session=<s1u7EABGteS+WYnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 15 21:56:16 host2 sshd[240370]: Disconnected from invalid user ubuntu 35.199.95.142 port 55742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 21:56:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<SlUmEwBGzoc+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-15 21:57:34 dovecot_plain authenticator failed for (lecty) [102.88.10.10]:37180: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-15 21:57:35 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:56140: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 15 21:57:56 host2 sshd[241581]: Disconnected from invalid user ylee 128.1.131.163 port 45686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.194.18.229
country_id: 3469034
description:
Dec 15 21:57:13 host2 sshd[241095]: Disconnected from invalid user www 186.194.18.229 port 52806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-15 21:57:30 dovecot_plain authenticator failed for (psings) [154.144.243.93]:60498: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-15 21:57:21 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:32979: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.194.18.229
country_id: 3469034
description:
Dec 15 21:59:29 host2 sshd[242667]: Disconnected from invalid user sammy 186.194.18.229 port 33560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-15 22:00:10 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:40938: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-12-15 21:59:57 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:47465: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 15 21:59:58 host2 sshd[242962]: Disconnected from invalid user jenkins 158.69.204.92 port 51894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 15 21:59:23 host2 sshd[242618]: Disconnected from invalid user web 158.69.204.92 port 59154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.204.92
country_id: 6251999
description:
Dec 15 22:00:33 host2 sshd[243582]: Disconnected from invalid user ylee 158.69.204.92 port 47798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Dec 15 22:00:44 host2 sshd[243704]: Disconnected from invalid user rc 107.175.70.59 port 56804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.194.18.229
country_id: 3469034
description:
Dec 15 22:00:57 host2 sshd[243800]: Disconnected from invalid user ops 186.194.18.229 port 58370 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.70.59
country_id: 6252001
description:
Dec 15 22:01:50 host2 sshd[244297]: Disconnected from invalid user sun 107.175.70.59 port 49894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.123
country_id: 1819730
description:
Dec 15 22:03:18 host2 sshd[245442]: Disconnected from invalid user ubuntu 23.91.96.123 port 47572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 15 22:04:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<s+1rLwBGltw+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 15 22:04:49 host2 sshd[246449]: Disconnected from invalid user rc 128.1.131.163 port 59536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 15 22:04:14 host2 sshd[246096]: Disconnected from invalid user php 128.1.131.163 port 52178 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 22:06:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<FKJZNgBGvuE+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.81.252
country_id: 2077456
description:
2025-12-15 22:06:40 dovecot_login authenticator failed for (ADMIN) [154.16.81.252]:42971: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.54
country_id: 3703430
description:
2025-12-15 22:07:39 dovecot_login authenticator failed for (ADMIN) [91.90.126.54]:33436: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-15 22:10:28 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:41018: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-15 22:10:57 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:43774: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-12-15 22:11:41 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:42381: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-15 22:11:17 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:60986: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-15 22:13:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58152: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-15 22:15:42 dovecot_plain authenticator failed for (spituate) [62.73.121.209]:52433: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-15 22:17:57 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:49915: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-12-15 22:18:14 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:57679: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 22:24:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ucMjdwBG9NY+PIcg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.49
country_id: 6252001
description:
Dec 15 22:25:02 host2 pure-ftpd[259790]: (?@147.185.132.49) [INFO] New connection from 147.185.132.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-15 22:26:46 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (netch) [73.208.81.125]:49792: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.19
country_id: 2264397
description:
2025-12-15 22:27:46 dovecot_login authenticator failed for (ADMIN) [146.70.59.19]:8145: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-15 22:27:59 dovecot_plain authenticator failed for (draffous) [65.20.148.194]:56939: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.180.157.88
country_id: 6252001
description:
Dec 15 22:27:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=52.180.157.88, lip=66.85.158.91, session=<FfnygQBG2rI0tJ1Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 15 22:29:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<9iZfiABGppU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-15 22:29:36 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:53840: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-15 22:30:25 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:37034: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 15 22:31:50 host2 sshd[264023]: Disconnected from invalid user zhangc 223.17.0.220 port 38134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.177.140
country_id: 3865483
description:
Dec 15 22:32:41 host2 sshd[264427]: Disconnected from invalid user ubuntu 186.122.177.140 port 62337 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-15 22:32:45 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:54310: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-15 22:33:51 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:34328: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 15 22:33:09 host2 sshd[264698]: Disconnected from invalid user sysuser 223.17.0.220 port 45092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Dec 15 22:33:41 host2 sshd[264939]: Disconnected from invalid user gopal 101.36.119.218 port 45114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.218
country_id: 1819730
description:
Dec 15 22:34:53 host2 sshd[265669]: Disconnected from invalid user bkp 101.36.119.218 port 50162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 15 22:35:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<F4wXnQBGDMo+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 15 22:35:39 host2 sshd[266273]: Disconnected from invalid user koha 223.17.0.220 port 41584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.46
country_id: 953987
description:
2025-12-15 22:37:08 dovecot_login authenticator failed for (ADMIN) [154.47.30.46]:26528: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.97
country_id: 130758
description:
2025-12-15 22:36:16 dovecot_plain authenticator failed for (localhost) [62.60.135.97]:50512: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-15 22:36:39 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:33206: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-15 22:37:12 dovecot_login authenticator failed for ([47.24.76.30]) [47.24.76.30]:57558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.8.250.134
country_id: 6252001
description:
2025-12-15 22:37:23 dovecot_login authenticator failed for ([4.8.250.134]) [4.8.250.134]:40016: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-15 22:37:39 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (dalbandon) [73.137.7.97]:46196: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 15 22:39:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<7hYMqwBGpsk+PIdh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.122.177.140
country_id: 3865483
description:
Dec 15 22:39:32 host2 sshd[268313]: Disconnected from invalid user xiaolong 186.122.177.140 port 31099 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.101
country_id: 130758
description:
2025-12-15 22:40:11 dovecot_plain authenticator failed for (localhost) [62.60.135.101]:55956: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 15 22:42:13 host2 sshd[269878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 15 22:42:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<lg7ztQBG9Ko+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.217
country_id: 2510769
description:
2025-12-15 22:44:13 dovecot_login authenticator failed for (ADMIN) [212.102.49.217]:57274: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-15 22:45:03 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (siging) [87.103.126.54]:60669: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 22:45:31 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:59650: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.53.197
country_id: 2802361
description:
Dec 15 22:46:42 host2 pure-ftpd[273370]: (?@130.211.53.197) [INFO] New connection from 130.211.53.197


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 15 22:47:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<qNIOyABG4qk+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-15 22:47:20 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (mapburic) [73.208.81.125]:36004: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 22:49:02 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:56284: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 22:49:09 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:48612: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 22:50:04 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:41952: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 15 22:50:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<F4Sg0gBGLLg+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-15 22:50:11 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:60056: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-15 22:51:39 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:4335: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-15 22:51:51 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:43319: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.18
country_id: 1269750
description:
Dec 15 22:55:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.8.118.18, lip=66.85.158.91, TLS, session=<SndG4wBG3r1nCHYS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 15 22:55:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<IjVS5QBG0rM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.242.162
country_id: 1269750
description:
Dec 15 22:55:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.18.242.162, lip=66.85.158.91, TLS, session=<9UyE5ABGr51nEvKi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 15 22:56:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<8H2K6gBGhOo+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 15 22:56:59 host2 pure-ftpd[280586]: (?@184.105.247.194) [INFO] New connection from 184.105.247.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.182
country_id: 294640
description:
2025-12-15 22:58:46 dovecot_login authenticator failed for (ADMIN) [149.88.26.182]:2838: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 22:59:29 host2 sshd[282228]: Disconnected from invalid user darian 62.60.131.157 port 14133 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.122
country_id: 719819
description:
2025-12-15 23:00:54 dovecot_login authenticator failed for (ADMIN) [86.106.74.122]:31192: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 15 23:01:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<1zgJ+wBGLO0+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 15 23:02:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bb5h/QBG7sw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-12-15 23:03:37 dovecot_plain authenticator failed for (parsm) [5.32.22.218]:54663: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-15 23:04:35 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:37926: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec 15 23:04:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<GU72BQFGHtZChJl/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-15 23:06:21 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (ronch) [73.224.171.101]:44998: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 15 23:06:23 host2 sshd[288104]: Disconnected from invalid user darian 62.60.131.157 port 63593 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-15 23:08:00 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:49614: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.134.113.36
country_id: 1269750
description:
Dec 15 23:10:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.134.113.36, lip=66.85.158.91, TLS, session=<xPUIHAFGDMZnhnEk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-15 23:10:23 dovecot_plain authenticator failed for (posubtles) [102.53.15.17]:40685: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.136
country_id: 3469034
description:
Dec 15 23:11:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=177.44.96.136, lip=66.85.158.91, TLS, session=<LGAAHgFG4JyxLGCI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-15 23:16:56 dovecot_login authenticator failed for ([84.214.48.79]) [84.214.48.79]:53515: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-15 23:18:49 dovecot_plain authenticator failed for (cidder) [75.97.190.237]:46007: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.59
country_id: 3865483
description:
2025-12-15 23:18:35 dovecot_login authenticator failed for (ADMIN) [146.70.38.59]:64181: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 34.27.42.6 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.41
country_id: 3175395
description:
Dec 15 23:21:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.15.171.41, lip=66.85.158.91, TLS, session=<8suKQQFGVry5D6sp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.63
country_id: 690791
description:
Dec 15 23:21:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.221.159.63, lip=66.85.158.91, TLS, session=<VLS9QgFGBLcl3Z8/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.63
country_id: 719819
description:
Dec 15 23:23:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=178.48.181.63, lip=66.85.158.91, TLS, session=<gLGGSQFGI9iyMLU/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.14
country_id: 798544
description:
Dec 15 23:23:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.125.4.14, lip=66.85.158.91, TLS, session=<bKOdSgFGGua5fQQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 15 23:23:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<9b6RSwFGDI8+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-15 23:24:14 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:46734: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-15 23:25:02 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:40700: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-15 23:27:22 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:44308: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 15 23:28:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<tODBWgFGxIY+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-15 23:28:21 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:36552: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.27
country_id: 3175395
description:
2025-12-15 23:28:48 dovecot_login authenticator failed for (ADMIN) [156.146.41.27]:39210: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-15 23:28:58 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:34074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-15 23:29:42 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:57770: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.97
country_id: 130758
description:
2025-12-15 23:30:53 dovecot_plain authenticator failed for (localhost) [62.60.135.97]:51194: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.116
country_id: 6252001
description:
Dec 15 23:30:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.116, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vj27ZAFGedBAPpx0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-15 23:31:05 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:42026: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-15 23:31:12 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:48936: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 15 23:31:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OuzbZQFGQFhAPpxs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.115.137
country_id: 6252001
description:
Dec 15 23:33:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.102.115.137, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<De1gbwFGftUUZnOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.101
country_id: 130758
description:
2025-12-15 23:34:42 dovecot_plain authenticator failed for (localhost) [62.60.135.101]:56908: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-15 23:35:31 dovecot_plain authenticator failed for (headulae) [94.201.22.158]:35679: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-15 23:35:46 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:45948: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-15 23:36:00 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:53166: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-15 23:37:25 dovecot_plain authenticator failed for (procer) [94.201.22.158]:44305: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 23:38:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<WuNNgAFGBOY+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.92
country_id: 130758
description:
2025-12-15 23:39:47 dovecot_plain authenticator failed for (localhost) [62.60.135.92]:56466: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.35
country_id: 289688
description:
2025-12-15 23:40:26 dovecot_login authenticator failed for (ADMIN) [95.181.234.35]:29552: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 15 23:42:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<D2ljjwFGroA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-15 23:43:27 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:33664: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-15 23:43:38 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (slies) [76.157.219.158]:38630: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.97
country_id: 130758
description:
2025-12-15 23:43:47 dovecot_plain authenticator failed for (localhost) [62.60.135.97]:37902: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-15 23:43:50 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:52666: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Dec 15 23:44:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<oYMqlgFG3EVBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.188
country_id: 6252001
description:
Dec 15 23:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.188, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bjoNlwFGvVJAPsW8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.92
country_id: 6252001
description:
Dec 15 23:44:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.92, lip=66.85.158.91, session=<5qC9lAFGyjtAPsVc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.62
country_id: 6252001
description:
Dec 15 23:44:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.62, lip=66.85.158.91, session=<HpuBlQFGdclBMQE+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-15 23:44:40 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:32774: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.140.234.172
country_id: 719819
description:
Dec 15 23:46:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=45.140.234.172, lip=66.85.158.91, TLS, session=<s3/1mQFGwustjOqs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.150
country_id: 798544
description:
Dec 15 23:46:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=178.216.25.150, lip=66.85.158.91, TLS, session=<M1DzmQFGbeyy2BmW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.45
country_id: 3865483
description:
Dec 15 23:45:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.251.45, lip=66.85.158.91, TLS, session=<gW6lmAFGoa6zAPst>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.210.75
country_id: 798544
description:
Dec 15 23:46:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=109.125.210.75, lip=66.85.158.91, TLS, session=<O5XxmQFGn9dtfdJL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 15 23:45:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8F8TmAFGoCVAPsW2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 15 23:45:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<comdmAFGvqbJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.227.16.83
country_id: 3469034
description:
Dec 15 23:45:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=186.227.16.83, lip=66.85.158.91, TLS, session=<J72hmAFGfbq64xBT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.73
country_id: 1269750
description:
Dec 15 23:45:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.18.166.73, lip=66.85.158.91, TLS, session=<DiepmAFGKu5nEqZJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.152
country_id: 3865483
description:
Dec 15 23:46:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=190.122.133.152, lip=66.85.158.91, TLS, session=<DO8vmgFGd7i+eoWY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-12-15 23:47:09 dovecot_login authenticator failed for ([128.185.194.22]) [128.185.194.22]:35814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-15 23:47:26 dovecot_login authenticator failed for (219-163-97-62.cust.smartcall.no) [62.97.163.219]:57342: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.97
country_id: 130758
description:
2025-12-15 23:51:20 dovecot_plain authenticator failed for (localhost) [62.60.135.97]:45702: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 15 23:52:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<cg3trwFG+M8+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 15 23:53:33 host2 sshd[319519]: Disconnected from invalid user weather 49.204.74.149 port 57142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 15 23:55:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<5t3AugFGWoo+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 15 23:55:44 host2 sshd[321561]: Disconnected from invalid user mohammad 67.10.185.103 port 43506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.94.190.205
country_id: 719819
description:
2025-12-15 23:56:38 dovecot_login authenticator failed for (ADMIN) [185.94.190.205]:62659: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-15 23:57:08 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:56103: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-15 23:57:25 dovecot_login authenticator failed for ([78.156.0.88]) [78.156.0.88]:41864: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 15 23:57:26 host2 sshd[322745]: Disconnected from invalid user weather 67.10.185.103 port 53608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-15 23:57:37 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:41354: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.187
country_id: 2510769
description:
2025-12-15 23:58:42 dovecot_login authenticator failed for (ADMIN) [212.102.49.187]:4978: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.20
country_id: 6252001
description:
Dec 15 23:59:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.20, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jHpMyQFGTogUQGgU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2025-12-16 00:00:08 dovecot_login authenticator failed for ([49.124.154.172]) [49.124.154.172]:53378: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 16 00:00:15 host2 sshd[324678]: Disconnected from invalid user newuser 49.204.74.149 port 41790 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-16 00:00:33 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:50799: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-16 00:00:58 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (thyth) [73.161.96.107]:41908: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 16 00:01:06 host2 sshd[325243]: Disconnected from invalid user developer 103.23.199.128 port 59176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-16 00:01:24 dovecot_login authenticator failed for ([152.52.246.198]) [152.52.246.198]:54020: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.4
country_id: 1733045
description:
2025-12-16 00:02:08 dovecot_login authenticator failed for ([49.124.132.4]) [49.124.132.4]:45438: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 16 00:02:49 host2 sshd[326025]: Disconnected from invalid user vyos 103.23.199.128 port 42736 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 16 00:03:38 host2 sshd[326745]: Disconnected from invalid user deploy 103.23.199.128 port 55586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Dec 16 00:04:27 host2 sshd[327188]: Disconnected from invalid user bobo 103.23.199.128 port 35904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 16 00:04:28 host2 sshd[327209]: Disconnected from invalid user developer 103.117.57.134 port 54500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-16 00:06:33 dovecot_plain authenticator failed for c-98-203-34-136.hsd1.fl.comcast.net (etroiding) [98.203.34.136]:52946: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 00:07:36 host2 sshd[329291]: Disconnected from invalid user jasmyn 62.60.131.157 port 44625 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-16 00:09:08 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (tation) [76.16.7.82]:52024: 535 Incorrect authentication data (set_id=hr@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 00:08:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<yGlQ6gFGcqg+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 00:08:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<QkjS6gFGRIQ+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 16 00:08:33 host2 sshd[329779]: Disconnected from invalid user vyos 103.117.57.134 port 38824 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 00:09:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<1nIE7wFGIuo+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 00:12:52 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:52176: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 16 00:12:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<OIzG+QFGSoI+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 00:13:15 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:36336: 535 Incorrect authentication data (set_id=contact@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.200
country_id: 798544
description:
2025-12-16 00:15:31 dovecot_login authenticator failed for (ADMIN) [138.199.59.200]:20426: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-16 00:20:19 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:37858: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.25
country_id: 2993457
description:
2025-12-16 00:21:42 dovecot_login authenticator failed for (ADMIN) [95.181.233.25]:8088: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-16 00:22:02 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:35253: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 00:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<5ObvHAJGDos+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-16 00:22:50 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:56961: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 00:29:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<CHF9NAJGEoM+PIde>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 00:29:26 host2 sshd[343512]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-16 00:30:08 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:60498: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-12-16 00:30:19 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:35332: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2025-12-16 00:30:33 dovecot_plain authenticator failed for c-73-188-252-208.hsd1.pa.comcast.net (beione) [73.188.252.208]:41278: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 00:30:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<DvPJOgJG+oE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-12-16 00:32:09 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:60604: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-16 00:33:02 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:52312: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2025-12-16 00:32:42 dovecot_login authenticator failed for ([182.95.87.3]) [182.95.124.206]:35002: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-16 00:32:52 dovecot_login authenticator failed for (cm-178.232.226.163.get.no) [178.232.226.163]:54273: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.40
country_id: 953987
description:
2025-12-16 00:32:53 dovecot_login authenticator failed for (ADMIN) [154.47.30.40]:53447: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-16 00:33:56 dovecot_login authenticator failed for ([125.18.219.209]) [27.123.102.122]:57130: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-16 00:34:12 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:57087: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 00:35:37 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aulcakins) [87.103.126.54]:20365: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-16 00:37:03 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:39967: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-16 00:36:16 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:51713: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-16 00:36:43 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:43414: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.42
country_id: 6252001
description:
2025-12-16 00:37:18 dovecot_login authenticator failed for ([98.181.46.42]) [98.181.46.42]:45963: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 00:38:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<EmqsVQJG5qc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-12-16 00:38:45 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:41378: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-16 00:39:05 dovecot_login authenticator failed for ([182.160.107.51]) [182.160.107.51]:55834: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 00:40:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<iFjOXAJGVNE+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 00:41:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<mUFxYAJGaKw+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 16 00:43:50 host2 pure-ftpd[353853]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 00:47:42 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:55278: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 00:48:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<XNnjegJGNqU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 00:51:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<r6H6gwJGgI4+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.45
country_id: 6252001
description:
2025-12-16 00:51:49 dovecot_login authenticator failed for ([70.174.168.45]) [70.174.168.45]:46620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-16 00:52:11 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:48615: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 00:52:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<YVvehwJGlIE+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.23
country_id: 146669
description:
2025-12-16 00:52:34 dovecot_login authenticator failed for (ADMIN) [185.253.162.23]:26418: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 00:53:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ddmuiwJGYus+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 00:56:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<c3fAlAJGHos+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.84.1.105
country_id: 3469034
description:
Dec 16 00:57:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=170.84.1.105, lip=66.85.158.91, TLS, session=<gBOBlwJGsdiqVAFp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec 16 00:57:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<vhQ2mwJGpoXCw3NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.60
country_id: 798544
description:
Dec 16 00:57:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=128.127.94.60, lip=66.85.158.91, TLS, session=<bkSnmAJGCYuAf148>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-16 00:58:21 dovecot_plain authenticator failed for (uniating) [199.192.123.12]:58756: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 16 01:00:42 host2 pure-ftpd[367310]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 01:00:46 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:43348: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 01:01:54 host2 sshd[368025]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Dec 16 01:04:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0h3DsgJGUN/Y2s5D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 01:05:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<JEQQtQJGys0+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.53
country_id: 6252001
description:
Dec 16 01:06:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FrUsugJGGd3G6xg1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 01:06:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<JQZnuQJGANw+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.37
country_id: 1814991
description:
2025-12-16 01:07:33 dovecot_login authenticator failed for (ADMIN) [188.241.80.37]:25880: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.83
country_id: 3175395
description:
2025-12-16 01:09:05 dovecot_login authenticator failed for (ADMIN) [156.146.41.83]:35786: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.112.9
country_id: 3469034
description:
Dec 16 01:13:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=177.39.112.9, lip=66.85.158.91, TLS, session=<atDe0gJGS4qxJ3AJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 01:14:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ioGf1gJGbJs+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 01:15:44 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:37132: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 01:16:09 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:45038: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.197.228
country_id: 2921044
description:
Dec 16 01:17:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=207.154.197.228, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<2qP94AJGq+DPmsXk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.197.228
country_id: 2921044
description:
Dec 16 01:17:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=207.154.197.228, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<pXlo4QJG/3TPmsXk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-16 01:17:48 dovecot_plain authenticator failed for (frend) [65.20.184.80]:50503: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 170.9.236.245
country_id: 6252001
description:
Dec 16 01:18:20 host2 sshd[380443]: error: maximum authentication attempts exceeded for root from 170.9.236.245 port 36788 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 170.9.236.245
country_id: 6252001
description:
Dec 16 01:18:20 host2 sshd[380443]: Disconnecting authenticating user root 170.9.236.245 port 36788: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.9.236.245
country_id: 6252001
description:
Dec 16 01:18:23 host2 sshd[380486]: Disconnecting invalid user admin 170.9.236.245 port 36844: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-16 01:20:17 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:53862: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.229
country_id: 2635167
description:
Dec 16 01:20:36 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.229, lip=66.85.158.91, TLS, session=<pHDC7AJGM6tX7LDl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-16 01:21:00 dovecot_login authenticator failed for ([182.95.7.193]) [182.95.59.154]:36856: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.244.210.242
country_id: 6252001
description:
Dec 16 01:21:01 host2 sshd[383005]: Invalid user cloudtourssrilan_travel from 162.244.210.242 port 62178


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.244.210.242
country_id: 6252001
description:
[2025-12-16 01:21:02 +0530] info [cpaneld] 162.244.210.242 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.14
country_id: 2562770
description:
2025-12-16 01:22:17 dovecot_login authenticator failed for (ADMIN) [176.125.230.14]:35843: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-16 01:23:06 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:40094: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 01:23:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<IT9V9gJG1J8+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.230.6
country_id: 798544
description:
Dec 16 01:23:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=193.43.230.6, lip=66.85.158.91, TLS, session=<Mz7T9gJGB9nBK+YG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.90.239.230
country_id: 3469034
description:
Dec 16 01:24:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=189.90.239.230, lip=66.85.158.91, TLS, session=<SAbw9wJGSqW9Wu/m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.115.104
country_id: 3469034
description:
Dec 16 01:26:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=177.87.115.104, lip=66.85.158.91, TLS, session=</DEiAANGIeyxV3No>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.209
country_id: 6252001
description:
Dec 16 01:25:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.209, lip=66.85.158.92, TLS, session=<W1bf/QJGtuLG6xjR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.148
country_id: 3469034
description:
Dec 16 01:25:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=191.240.37.148, lip=66.85.158.91, TLS, session=<bAvs/gJGKbW/8CWU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 01:26:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<AqNBAgNGQuE+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 01:28:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<0v8xBwNGpNM+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Dec 16 01:30:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<jYztDgNGFHynXpI0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 01:32:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<A2hkFgNGaKQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.40
country_id: 617790
description:
2025-12-16 01:33:15 dovecot_login authenticator failed for (ADMIN) [178.175.128.40]:63402: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.53.197.185
country_id: 798549
description:
Dec 16 01:34:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.53.197.185, lip=66.85.158.91, session=<4X/tHgNGY/W5NcW5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 01:34:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<DfTwHwNG7oY+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.45
country_id: 6252001
description:
2025-12-16 01:39:10 dovecot_login authenticator failed for (ADMIN) [37.19.221.45]:44062: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 01:43:33 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:50774: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-16 01:44:45 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:59440: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 01:45:14 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:38140: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-16 01:45:15 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:34278: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-16 01:45:36 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:56770: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 01:46:39 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:46390: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2025-12-16 01:46:59 dovecot_plain authenticator failed for c-24-61-199-212.hsd1.ct.comcast.net (unlan) [24.61.199.212]:40186: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2025-12-16 01:48:42 dovecot_login authenticator failed for ([180.94.76.126]) [180.94.76.126]:45577: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-16 01:49:05 dovecot_login authenticator failed for ([125.20.249.192]) [27.123.113.10]:46224: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 01:50:16 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:59680: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 01:50:23 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:50776: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 01:51:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<iT6pWQNGDOc+PIMp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 16 01:51:51 host2 sshd[405567]: Disconnected from invalid user ossuser 42.200.78.78 port 51844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 16 01:52:27 host2 sshd[405921]: Disconnected from invalid user ec2-user 42.200.78.78 port 35804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-16 01:52:44 dovecot_plain authenticator failed for (sallorha) [65.20.133.208]:33463: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.115
country_id: 3144096
description:
2025-12-16 01:53:30 dovecot_login authenticator failed for (ADMIN) [46.246.122.115]:51266: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 01:53:37 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (jazooking) [87.103.126.54]:28645: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 16 01:53:42 host2 sshd[406714]: Disconnected from invalid user marvin 170.233.151.14 port 39854 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 16 01:56:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<zeCbawNGmMTBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 01:56:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<sY94bANGgK4+PIco>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 16 01:55:33 host2 sshd[409038]: Disconnected from invalid user test 170.233.151.14 port 49628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.173
country_id: 2635167
description:
2025-12-16 01:55:40 dovecot_login authenticator failed for (ADMIN) [158.173.23.173]:25943: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-16 01:57:16 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (unatifened) [72.241.202.216]:52146: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-16 01:57:32 dovecot_plain authenticator failed for (exces) [12.150.243.22]:53146: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 01:59:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<3pXkdgNGaug+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.32.104
country_id: 1269750
description:
2025-12-16 02:01:04 dovecot_login authenticator failed for (183.82.32.104.actcorp.in) [183.82.32.104]:51739: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.185
country_id: 3144096
description:
2025-12-16 02:00:50 dovecot_login authenticator failed for ([84.215.111.185]) [84.215.111.185]:57765: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-12-16 02:02:12 dovecot_plain authenticator failed for (colanic) [84.238.92.245]:56744: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 02:02:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Fq/ZgQNGZqw+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-16 02:01:37 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:37108: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 02:01:53 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:51516: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 02:02:58 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:54256: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 16 02:05:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0xC2iwNG/tNChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.52
country_id: 130758
description:
2025-12-16 02:06:19 dovecot_plain authenticator failed for (localhost) [62.60.131.52]:42814: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.52
country_id: 130758
description:
2025-12-16 02:06:26 dovecot_plain authenticator failed for (localhost) [62.60.131.52]:49364: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 02:06:40 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:37012: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.101.123.29
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 34.101.123.29 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.45
country_id: 2542007
description:
2025-12-16 02:09:17 dovecot_login authenticator failed for (ADMIN) [95.181.232.45]:41702: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-16 02:10:35 dovecot_login authenticator failed for ([128.185.224.142]) [27.123.97.74]:60636: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-16 02:10:49 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:36192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-16 02:10:53 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (harrass) [73.183.74.177]:36718: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 02:11:28 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:60392: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 02:14:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<1ivQqwNGUJQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-16 02:14:19 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:49814: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-16 02:14:34 dovecot_login authenticator failed for (nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:51084: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 02:15:58 host2 sshd[422445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 02:15:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<k74usQNGMMY+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-12-16 02:16:00 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:42941: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-16 02:17:26 dovecot_plain authenticator failed for (drocals) [5.11.140.219]:54646: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 02:17:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jOSGuANGQrw+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 02:19:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<TMBsvgNGiMY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.8
country_id: 6252001
description:
2025-12-16 02:19:39 dovecot_login authenticator failed for (ADMIN) [181.214.165.8]:62300: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 02:21:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<HjoXyANGFtY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 02:23:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<pfmyzANGTqs+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 16 02:24:50 host2 sshd[427507]: Disconnected from invalid user admin123 160.251.101.169 port 52742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 02:26:18 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:44822: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-16 02:25:40 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:44492: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 02:26:25 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:34732: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.18
country_id: 3194884
description:
2025-12-16 02:27:06 dovecot_login authenticator failed for (ADMIN) [176.125.229.18]:53821: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 16 02:27:18 host2 sshd[429204]: Disconnected from invalid user gustavo 160.251.101.169 port 54970 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 02:27:45 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:53478: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 16 02:29:21 host2 sshd[430515]: Disconnected from invalid user ftptest 160.251.101.169 port 55238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 16 02:29:23 host2 sshd[430525]: Disconnected from invalid user ftpadmin 121.52.147.5 port 45354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-16 02:31:19 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:49914: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-12-16 02:31:31 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:54884: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 02:31:32 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:49934: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 16 02:31:53 host2 sshd[432477]: Disconnected from invalid user bvpn 121.52.147.5 port 40954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 16 02:32:31 host2 sshd[432912]: Disconnected from invalid user teamspeak 121.52.147.5 port 59070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 02:32:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<mRQs7wNGCNA+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 02:34:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (berginss) [87.103.126.54]:43068: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.27
country_id: 6252001
description:
Dec 16 02:35:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.27, lip=66.85.158.92, TLS, session=<C/fq+QNGLuyTuYQb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 02:37:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<BTUOAARGSI0+PIcd>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.135.29
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[62.60.135.29] [Remote Port]=[36168] [Authentication Database]=[mail] [Username]=[info@kiriaswanu.com] (10/10 failures) (blocked until [Tue Dec 16 21:07:39 2025 UTC/Wed Dec 17 02:37:39 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.167
country_id: 1269750
description:
Dec 16 02:38:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=103.172.11.167, lip=66.85.158.91, TLS, session=<C1SvAgRGmrFnrAun>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.52
country_id: 3175395
description:
Dec 16 02:38:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.197.9.52, lip=66.85.158.91, TLS, session=<5+vaAwRGyoW5xQk0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.4
country_id: 6252001
description:
Dec 16 02:40:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.4, lip=66.85.158.91, session=<fzk+CgRGPEOsaAsE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.20
country_id: 2661886
description:
2025-12-16 02:40:59 dovecot_login authenticator failed for (ADMIN) [46.246.8.20]:21253: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 02:42:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Dd/VDwRGFtI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.7
country_id: 2562770
description:
2025-12-16 02:44:34 dovecot_login authenticator failed for (ADMIN) [176.125.230.7]:44994: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 02:46:46 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:60688: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 02:48:07 host2 sshd[444644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 02:48:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<Te6LJgRGUOo+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 16 02:48:52 host2 sshd[445137]: Disconnected from invalid user nexus 95.85.114.218 port 44784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 16 02:49:27 host2 sshd[445530]: Disconnected from invalid user noroot 45.138.158.114 port 43984 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.243.15
country_id: 6252001
description:
2025-12-16 02:50:28 dovecot_login authenticator failed for wsip-184-191-243-15.fv.ks.cox.net [184.191.243.15]:43158: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 02:50:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50774: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-16 02:50:53 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:36242: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 16 02:51:37 host2 sshd[447417]: Disconnected from invalid user gabriel 45.138.158.114 port 38136 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 16 02:51:58 host2 sshd[447652]: Received disconnect from 95.85.114.218 port 41016:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 16 02:52:22 host2 sshd[447968]: Disconnected from invalid user teamspeak 95.85.114.218 port 52242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 16 02:52:35 host2 sshd[448132]: Disconnected from invalid user arthur 103.179.56.9 port 60488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Dec 16 02:53:09 host2 sshd[448526]: Disconnected from invalid user arthur 95.85.114.218 port 39400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 16 02:53:26 host2 sshd[448695]: Disconnected from invalid user arthur 45.138.158.114 port 56322 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 02:54:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<rxTjPARGVuw+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.56.9
country_id: 1643084
description:
Dec 16 02:55:05 host2 sshd[450374]: Disconnected from invalid user gabriel 103.179.56.9 port 32928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 02:59:45 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:55370: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 16 02:59:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<0YKtTwRGtMk+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 02:59:59 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:39358: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.135.31
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[62.60.135.31] [Authentication Database]=[mail] [Username]=[info@essenceceylontea.com] (10/10 failures) (blocked until [Tue Dec 16 21:29:57 2025 UTC/Wed Dec 17 02:59:57 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.227
country_id: 294640
description:
2025-12-16 03:01:03 dovecot_login authenticator failed for (ADMIN) [149.88.26.227]:60055: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 03:04:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<QzMxXwRGApY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.39
country_id: 2562770
description:
2025-12-16 03:04:33 dovecot_login authenticator failed for (ADMIN) [176.125.230.39]:54902: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.148.16
country_id: 690791
description:
Dec 16 03:05:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@v-deploy.com>, method=PLAIN, rip=37.221.148.16, lip=66.85.158.91, TLS, session=<sJZ/ZARGgKUl3ZQQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.76
country_id: 798544
description:
Dec 16 03:06:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.249.76, lip=66.85.158.91, TLS, session=<w62YZQRGbtRtfflM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 16 03:06:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<jW5BaQRG2JPPWvQc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 16 03:06:59 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS, session=<e5c6aQRGMIPPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-16 03:08:06 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:46154: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.170
country_id: 226074
description:
Dec 16 03:08:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=196.0.107.170, lip=66.85.158.91, TLS, session=<PN0vbwRGo5rEAGuq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.225
country_id: 1269750
description:
Dec 16 03:09:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=103.59.134.225, lip=66.85.158.91, TLS, session=<fSF9cARG+o5nO4bh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 16 03:11:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<tkkdewRGDulChJly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 03:12:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9937ewRG7Mk+PIdp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 16 03:13:22 host2 pure-ftpd[462577]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.64
country_id: 798544
description:
Dec 16 03:15:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=128.127.94.64, lip=66.85.158.91, TLS, session=<WPf5hQRG3ZuAf15A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.104
country_id: 953987
description:
Dec 16 03:15:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=102.64.42.104, lip=66.85.158.91, TLS, session=<WlwihwRGldVmQCpo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 03:15:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<9mggiQRGVOs+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.85
country_id: 3017382
description:
2025-12-16 03:16:21 dovecot_login authenticator failed for (ADMIN) [203.188.183.85]:37226: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-16 03:16:52 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:60900: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.178.110.48
country_id: 732800
description:
[2025-12-16 03:17:01 +0530] info [cpaneld] 195.178.110.48 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-16 03:16:31 dovecot_login authenticator failed for ([84.214.48.79]) [84.214.48.79]:43943: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.121.199.188
country_id: 1733045
description:
[2025-12-16 03:17:58 +0530] info [whostmgrd] 121.121.199.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-16 03:20:10 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:57823: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.130.248.95
country_id: 2510769
description:
2025-12-16 03:20:30 dovecot_login authenticator failed for 95.82-130-248.dynamic.clientes.euskaltel.es [82.130.248.95]:36076: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-16 03:20:47 dovecot_login authenticator failed for (cm-46.212.111.48.get.no) [46.212.111.48]:47231: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 03:26:34 host2 sshd[469368]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 03:27:31 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:59578: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 03:28:47 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:55360: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-16 03:28:57 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:54860: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.60
country_id: 1880251
description:
Dec 16 03:30:19 host2 sshd[471982]: Disconnected from invalid user sftpuser 45.78.201.60 port 55068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 03:30:23 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (quitrilly) [87.103.126.54]:1995: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 03:31:56 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:34670: 535 Incorrect authentication data (set_id=info@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.22
country_id: 3194884
description:
2025-12-16 03:32:06 dovecot_login authenticator failed for (ADMIN) [176.125.229.22]:46415: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-12-16 03:32:19 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:37105: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 03:32:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<y7AZxQRGBoU+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2025-12-16 03:33:28 dovecot_login authenticator failed for (ADMIN) [185.225.28.227]:32690: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 03:33:46 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:54124: 535 Incorrect authentication data (set_id=info@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-16 03:34:11 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (deizing) [98.227.25.115]:44534: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.52.208.37
country_id: 3865483
description:
[2025-12-16 03:34:49 +0530] info [cpaneld] 191.52.208.37 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.201.238.216
country_id: 3996063
description:
[2025-12-16 03:35:02 +0530] info [cpaneld] 187.201.238.216 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-16 03:35:02 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (pomid) [73.197.236.163]:57624: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-16 03:35:06 dovecot_plain authenticator failed for (tabiromy) [65.20.133.208]:54418: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.76.169
country_id: 3469034
description:
[2025-12-16 03:35:14 +0530] info [cpaneld] 170.82.76.169 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.139.224.78
country_id: 3865483
description:
[2025-12-16 03:34:42 +0530] info [cpaneld] 186.139.224.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.12.97.66
country_id: 6252001
description:
[2025-12-16 03:34:50 +0530] info [cpaneld] 104.12.97.66 - lezzarotec "GET /login/?login_only=1&user=lezzarotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.99.250.97
country_id: 1562822
description:
[2025-12-16 03:34:56 +0530] info [cpaneld] 116.99.250.97 - lezzarote "GET /login/?login_only=1&user=lezzarote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.95.83
country_id: 6252001
description:
[2025-12-16 03:34:58 +0530] info [cpaneld] 12.74.95.83 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.91.81.132
country_id: 3686110
description:
[2025-12-16 03:35:06 +0530] info [cpaneld] 191.91.81.132 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.130.162.9
country_id: 3624060
description:
[2025-12-16 03:35:12 +0530] info [cpaneld] 45.130.162.9 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.0.72.75
country_id: 3469034
description:
[2025-12-16 03:34:39 +0530] info [cpaneld] 179.0.72.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.236.174.218
country_id: 285570
description:
[2025-12-16 03:34:44 +0530] info [cpaneld] 188.236.174.218 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.252.143
country_id: 6252001
description:
[2025-12-16 03:34:45 +0530] info [whostmgrd] 129.222.252.143 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.247.206.193
country_id: 6252001
description:
[2025-12-16 03:34:59 +0530] info [cpaneld] 216.247.206.193 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.208.98.106
country_id: 6252001
description:
[2025-12-16 03:35:00 +0530] info [cpaneld] 76.208.98.106 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.172.142.3
country_id: 3865483
description:
[2025-12-16 03:35:08 +0530] info [cpaneld] 45.172.142.3 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.201.115.191
country_id: 2921044
description:
[2025-12-16 03:35:10 +0530] info [cpaneld] 79.201.115.191 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 16 03:35:34 host2 sshd[475535]: Disconnected from invalid user yudi 51.38.98.14 port 51508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 03:35:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mZPP0ARGUtM+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.175.151.48
country_id: 130758
description:
Dec 16 03:37:12 host2 sshd[476979]: Disconnected from invalid user ubuntu 79.175.151.48 port 60880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Dec 16 03:36:33 host2 sshd[476297]: Disconnected from invalid user alex 79.175.151.48 port 56268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.98.14
country_id: 3017382
description:
Dec 16 03:36:38 host2 sshd[476516]: Disconnected from invalid user papa 51.38.98.14 port 42190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Dec 16 03:36:44 host2 sshd[476570]: Disconnected from invalid user dockeradmin 156.54.170.192 port 42015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 03:38:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<dFla2ARGfrk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 16 03:39:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<c0w43ARGGJ4+PIdr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.170.192
country_id: 3175395
description:
Dec 16 03:39:59 host2 sshd[479131]: Disconnected from invalid user rke 156.54.170.192 port 56496 [preauth]


